Analysis
-
max time kernel
150s -
max time network
198s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
17-05-2021 21:31
Static task
static1
Behavioral task
behavioral1
Sample
4df346a12ef5679ec0b960d037c8f52a.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
4df346a12ef5679ec0b960d037c8f52a.exe
Resource
win10v20210410
General
-
Target
4df346a12ef5679ec0b960d037c8f52a.exe
-
Size
554KB
-
MD5
4df346a12ef5679ec0b960d037c8f52a
-
SHA1
65efd3a10061179a689c71bf2f47bf72d632b210
-
SHA256
b543eff3487cfe5e18d6a4dcd26f21ea04ce8e689d01d72fdbf2f422e451d20b
-
SHA512
03a5621cc571457ef22e915f1bb0632f5649168fd230fb9fd0dca7a817778584019feeb1d4032c7c9d505fb2faccbf8fd30903043a0aeca09bf86344537db295
Malware Config
Extracted
cybergate
v3.4.2.2
remote
asade.no-ip.org:25565
G164JO6TGAX8GC
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
rdns
-
install_file
windows
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
erdsvexcv
-
regkey_hklm
werwdsf
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Qlezrhhlbmw.exepid process 1504 Qlezrhhlbmw.exe -
Processes:
resource yara_rule behavioral1/memory/1780-110-0x00000000104F0000-0x0000000010560000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
4df346a12ef5679ec0b960d037c8f52a.exepid process 628 4df346a12ef5679ec0b960d037c8f52a.exe 628 4df346a12ef5679ec0b960d037c8f52a.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Qlezrhhlbmw.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Qlezrhhlbmw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\werwdsf = "C:\\Program Files (x86)\\rdns\\windows" Qlezrhhlbmw.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run Qlezrhhlbmw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\erdsvexcv = "C:\\Program Files (x86)\\rdns\\windows" Qlezrhhlbmw.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Qlezrhhlbmw.exedescription ioc process File created C:\Program Files (x86)\rdns\windows Qlezrhhlbmw.exe File opened for modification C:\Program Files (x86)\rdns\windows Qlezrhhlbmw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
explorer.exedescription pid process Token: SeDebugPrivilege 1780 explorer.exe Token: SeDebugPrivilege 1780 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Qlezrhhlbmw.exepid process 1504 Qlezrhhlbmw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4df346a12ef5679ec0b960d037c8f52a.exeQlezrhhlbmw.exedescription pid process target process PID 628 wrote to memory of 1504 628 4df346a12ef5679ec0b960d037c8f52a.exe Qlezrhhlbmw.exe PID 628 wrote to memory of 1504 628 4df346a12ef5679ec0b960d037c8f52a.exe Qlezrhhlbmw.exe PID 628 wrote to memory of 1504 628 4df346a12ef5679ec0b960d037c8f52a.exe Qlezrhhlbmw.exe PID 628 wrote to memory of 1504 628 4df346a12ef5679ec0b960d037c8f52a.exe Qlezrhhlbmw.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe PID 1504 wrote to memory of 1748 1504 Qlezrhhlbmw.exe iexplore.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4df346a12ef5679ec0b960d037c8f52a.exe"C:\Users\Admin\AppData\Local\Temp\4df346a12ef5679ec0b960d037c8f52a.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Qlezrhhlbmw.exe"C:\Users\Admin\AppData\Local\Temp\Qlezrhhlbmw.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtMD5
935e642050a272c380808b8480d9ad44
SHA141f30ddf35ae5557f5e93d2eb2a12e3a9bc55736
SHA2560bfc439de13688071fea7e21ada62c63d454566cf95bce8f3c2aa05cf12e6114
SHA512304a52f55a4d6edcd8f572c5087b2287dad2f9aaf6ae8f049ddd61876fe56c32782a2431e7bc30a2769867a883e2a410364fd5a8ef5b311966760ac1bfc1221e
-
C:\Users\Admin\AppData\Local\Temp\Qlezrhhlbmw.exeMD5
2cad1ad59e145139cbab70260b1a2f19
SHA1fd9e2ef2fd2b3b42fdc1dfbb32090a18e81a0f5a
SHA25601eeddf976a9c532e7a9fac7db766496b6718a0600440599f07bf0c75ddd7cd7
SHA5126ec2c51d4139b50042fd19403c235c38cb1d4275b772f88c17545dfc5da969fde7403666be4e8f95c3271b160fce805bb69da0a00812610109701cd5b50226e7
-
C:\Users\Admin\AppData\Local\Temp\Qlezrhhlbmw.exeMD5
2cad1ad59e145139cbab70260b1a2f19
SHA1fd9e2ef2fd2b3b42fdc1dfbb32090a18e81a0f5a
SHA25601eeddf976a9c532e7a9fac7db766496b6718a0600440599f07bf0c75ddd7cd7
SHA5126ec2c51d4139b50042fd19403c235c38cb1d4275b772f88c17545dfc5da969fde7403666be4e8f95c3271b160fce805bb69da0a00812610109701cd5b50226e7
-
\Users\Admin\AppData\Local\Temp\Qlezrhhlbmw.exeMD5
2cad1ad59e145139cbab70260b1a2f19
SHA1fd9e2ef2fd2b3b42fdc1dfbb32090a18e81a0f5a
SHA25601eeddf976a9c532e7a9fac7db766496b6718a0600440599f07bf0c75ddd7cd7
SHA5126ec2c51d4139b50042fd19403c235c38cb1d4275b772f88c17545dfc5da969fde7403666be4e8f95c3271b160fce805bb69da0a00812610109701cd5b50226e7
-
\Users\Admin\AppData\Local\Temp\Qlezrhhlbmw.exeMD5
2cad1ad59e145139cbab70260b1a2f19
SHA1fd9e2ef2fd2b3b42fdc1dfbb32090a18e81a0f5a
SHA25601eeddf976a9c532e7a9fac7db766496b6718a0600440599f07bf0c75ddd7cd7
SHA5126ec2c51d4139b50042fd19403c235c38cb1d4275b772f88c17545dfc5da969fde7403666be4e8f95c3271b160fce805bb69da0a00812610109701cd5b50226e7
-
memory/628-61-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/628-59-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1504-66-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1504-64-0x0000000000000000-mapping.dmp
-
memory/1780-71-0x0000000000000000-mapping.dmp
-
memory/1780-73-0x0000000074CF1000-0x0000000074CF3000-memory.dmpFilesize
8KB
-
memory/1780-76-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1780-75-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/1780-110-0x00000000104F0000-0x0000000010560000-memory.dmpFilesize
448KB