Analysis
-
max time kernel
155s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 13:55
Static task
static1
Behavioral task
behavioral1
Sample
a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe
Resource
win7-20220901-en
General
-
Target
a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe
-
Size
340KB
-
MD5
6dae87fc0043e2ed7af7d567c3f43320
-
SHA1
938e5fb9394b32f8769affab118587a513ba4eae
-
SHA256
a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97
-
SHA512
4c8c327ef01d072a3c8b77cbc66d11bd6e0f8b1e8548be8bd6eb25981232caa0fdaf3994674dde6b4727880216f1a1562eb5eb012a8257bf087d377531353b33
-
SSDEEP
6144:yR6CiG8KotTmhJ4KK2LNbbAS1B6Hr1fwdCsGlS17ZCu3+z:yR6Cr8KoK3V8S+HGt1VCW
Malware Config
Extracted
cybergate
2.6
Victima
socorsovolpe.no-ip.biz:81
***xMUTEx***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
windowss
-
install_file
systema.dlll
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
123456789
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\windowss\\systema.dlll" vbc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\windowss\\systema.dlll" vbc.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
explorer.exevbc.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5T551R1X-V762-R12W-70O6-J451HI4CXE16} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5T551R1X-V762-R12W-70O6-J451HI4CXE16}\StubPath = "C:\\Windows\\windowss\\systema.dlll" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5T551R1X-V762-R12W-70O6-J451HI4CXE16} vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5T551R1X-V762-R12W-70O6-J451HI4CXE16}\StubPath = "C:\\Windows\\windowss\\systema.dlll Restart" vbc.exe -
Processes:
resource yara_rule behavioral2/memory/3416-134-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3416-136-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3416-137-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3416-139-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3416-141-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/3416-146-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/4912-149-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/4912-152-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3416-154-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/3416-159-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/3416-163-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1708-162-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/1708-164-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/1708-165-0x0000000004900000-0x000000000494B000-memory.dmp upx behavioral2/memory/1708-166-0x0000000004950000-0x000000000499B000-memory.dmp upx behavioral2/memory/1708-167-0x00000000049A0000-0x00000000049EB000-memory.dmp upx behavioral2/memory/1708-168-0x0000000024160000-0x00000000241C2000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\windowss\\systema.dlll" vbc.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\windowss\\systema.dlll" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exedescription pid process target process PID 2448 set thread context of 3416 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe vbc.exe -
Drops file in Windows directory 4 IoCs
Processes:
vbc.exevbc.exedescription ioc process File created C:\Windows\windowss\systema.dlll vbc.exe File opened for modification C:\Windows\windowss\systema.dlll vbc.exe File opened for modification C:\Windows\windowss\systema.dlll vbc.exe File opened for modification C:\Windows\windowss\ vbc.exe -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vbc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 vbc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 vbc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vbc.exe -
Modifies registry class 2 IoCs
Processes:
vbc.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings vbc.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exevbc.exepid process 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe 3416 vbc.exe 3416 vbc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vbc.exepid process 1708 vbc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exevbc.exedescription pid process Token: SeDebugPrivilege 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe Token: SeDebugPrivilege 1708 vbc.exe Token: SeDebugPrivilege 1708 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
vbc.exepid process 3416 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1312 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exevbc.exedescription pid process target process PID 2448 wrote to memory of 3416 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe vbc.exe PID 2448 wrote to memory of 3416 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe vbc.exe PID 2448 wrote to memory of 3416 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe vbc.exe PID 2448 wrote to memory of 3416 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe vbc.exe PID 2448 wrote to memory of 3416 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe vbc.exe PID 2448 wrote to memory of 3416 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe vbc.exe PID 2448 wrote to memory of 3416 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe vbc.exe PID 2448 wrote to memory of 3416 2448 a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe vbc.exe PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE PID 3416 wrote to memory of 3060 3416 vbc.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe"C:\Users\Admin\AppData\Local\Temp\a4b42568472f4760b7546fddbb45dbf34f0a0c3de9ee55c80e1740b37249ea97.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD523ad311865a02b862ae5d12a34e4da09
SHA18531371cd8f6ff2e9ddba94c4d2c0171d7641959
SHA256f9cd3544ece03d558ed52e06735c641cdb9879bc5c857359c7ee42e1ba67d6f4
SHA5125c1289540ee4b697f2d0d0928beec5f475049fbc0004db070535a6f8a2a8c174c9237ffc95a60132451b531d002b6cc7b4399111405065d8dc07ab086d5286a6
-
C:\Windows\windowss\systema.dlllFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/1708-162-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/1708-168-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/1708-167-0x00000000049A0000-0x00000000049EB000-memory.dmpFilesize
300KB
-
memory/1708-166-0x0000000004950000-0x000000000499B000-memory.dmpFilesize
300KB
-
memory/1708-165-0x0000000004900000-0x000000000494B000-memory.dmpFilesize
300KB
-
memory/1708-164-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/1708-158-0x0000000000000000-mapping.dmp
-
memory/2448-138-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/2448-132-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/3416-137-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3416-134-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3416-136-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3416-154-0x00000000240F0000-0x0000000024152000-memory.dmpFilesize
392KB
-
memory/3416-159-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/3416-163-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3416-146-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/3416-141-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/3416-139-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3416-133-0x0000000000000000-mapping.dmp
-
memory/4912-149-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/4912-145-0x0000000000000000-mapping.dmp
-
memory/4912-152-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB