Analysis
- max time kernel
151s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/05/2021, 16:51
Static task
static1
Behavioral task
behavioral1
Sample
3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe
- Size 784KB
- Sample210529-esqevdhhcs
- SHA256 c02d6bf7da26beacb94946e5eeeef6fe1ecdcea66f3e1c517cebd9c06b9c19b5
- MD5 3df331c6547dae5ecd7d79addba9ecb5
- SHA1 b99a6e536474238b568c2687bef4a6eeab77f00c
- SHA512 c3c9a9f168602e2c3d51b7c687f66e6d86fc904ca3d7c08a798d87ee1ceb70475a239be2edc95bb44ebee615a9a520ee6092beb0c242ae76ae0c306907c6b3fe
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- CyberGate Payload 4 IoCs
resource yara_rule behavioral2/memory/744-116-0x0000000000400000-0x0000000000450000-memory.dmp family_cybergate behavioral2/memory/744-117-0x000000000040BBF4-mapping.dmp family_cybergate behavioral2/memory/744-118-0x0000000000400000-0x0000000000450000-memory.dmp family_cybergate behavioral2/memory/3700-195-0x000000000040BBF4-mapping.dmp family_cybergate - Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Winlogui\\csrss.exe" 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Winlogui\\csrss.exe" 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE - Executes dropped EXE 2 IoCs
pid Process 2152 csrss.exe 3700 csrss.EXE - Modifies Installed Components in the registry 2 TTPs
-
resource yara_rule behavioral2/memory/1868-159-0x0000000024080000-0x00000000240E2000-memory.dmp upx - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Smart Essentials = "C:\\Windows\\Winlogui\\csrss.exe" 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\Winlogui\\csrss.exe" 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 852 set thread context of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 2152 set thread context of 3700 2152 csrss.exe 81 - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Winlogui\csrss.exe 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE File opened for modification C:\Windows\Winlogui\csrss.exe 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE File opened for modification C:\Windows\Winlogui\csrss.exe explorer.exe File opened for modification C:\Windows\Winlogui\ explorer.exe File opened for modification C:\Windows\Winlogui\csrss.EXE csrss.exe - Program crash 2 IoCs
pid pid_target Process procid_target 2204 3648 WerFault.exe 77 512 3700 WerFault.exe 81 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance explorer.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3648 explorer.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3648 explorer.exe Token: SeDebugPrivilege 3648 explorer.exe Token: SeRestorePrivilege 2204 WerFault.exe Token: SeBackupPrivilege 2204 WerFault.exe Token: SeDebugPrivilege 2204 WerFault.exe Token: SeDebugPrivilege 512 WerFault.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 2152 csrss.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 852 wrote to memory of 744 852 3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe 75 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23 PID 744 wrote to memory of 8 744 3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE 23
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe"C:\Users\Admin\AppData\Local\Temp\3DF331C6547DAE5ECD7D79ADDBA9ECB5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE"C:\Users\Admin\AppData\Local\Temp\3DF331C6547DAE5ECD7D79ADDBA9ECB5.EXE"3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:1868
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 16725⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\Winlogui\csrss.exe"C:\Windows\Winlogui\csrss.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2152 -
C:\Windows\Winlogui\csrss.EXE"C:\Windows\Winlogui\csrss.EXE"6⤵
- Executes dropped EXE
PID:3700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 6047⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:512
-
-
-
-
-
-