Analysis
-
max time kernel
153s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
General
-
Target
7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe
-
Size
479KB
-
MD5
a17e4519a6e005f7fd867703639a15a7
-
SHA1
23e6bc4906b190a33203cd489ede1d499e819cad
-
SHA256
7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9
-
SHA512
e47a3eae65661119b7900d95c1a8f5edc80d55a6d1110aea53d13aaf408447eef73165e866ee74907ad1483c53396835143c1534a956b933fe224f3da4d28a04
-
SSDEEP
12288:tzPC0M438po70VxFFVJYCNp18mXxt2p7mOEvdwmQEd7bOuf+eube:hFs+ITxtK46Ywh
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Trial version
Botnet
Victime
C2
tarik775.no-ip.org:81
Mutex
XO6853ER546413
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
BOOT
-
install_file
msnmsgr.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
008
-
regkey_hkcu
Windows Live Messenger
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Live Messenger = "C:\\Program Files (x86)\\BOOT\\msnmsgr.exe" vbc.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Live Messenger = "C:\\Program Files (x86)\\BOOT\\msnmsgr.exe" vbc.exe -
Executes dropped EXE 1 IoCs
pid Process 1264 msnmsgr.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{G5CM43AU-R0BN-3OW8-K1X3-J0FQ1HPD61JI} vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{G5CM43AU-R0BN-3OW8-K1X3-J0FQ1HPD61JI}\StubPath = "C:\\Program Files (x86)\\BOOT\\msnmsgr.exe Restart" vbc.exe -
resource yara_rule behavioral1/memory/1108-87-0x0000000010410000-0x0000000010482000-memory.dmp upx behavioral1/memory/1108-93-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral1/memory/440-98-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral1/memory/440-101-0x0000000010490000-0x0000000010502000-memory.dmp upx -
Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msnmsgr.exe vbc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ vbc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msnmsgr.exe vbc.exe -
Loads dropped DLL 1 IoCs
pid Process 1108 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Live Messenger = "C:\\Program Files (x86)\\BOOT\\msnmsgr.exe" vbc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1676 set thread context of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1992 set thread context of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\BOOT\msnmsgr.exe vbc.exe File created C:\Program Files (x86)\BOOT\msnmsgr.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe Token: SeDebugPrivilege 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe Token: SeBackupPrivilege 440 vbc.exe Token: SeRestorePrivilege 440 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1108 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 28 PID 1676 wrote to memory of 1992 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 29 PID 1676 wrote to memory of 1992 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 29 PID 1676 wrote to memory of 1992 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 29 PID 1676 wrote to memory of 1992 1676 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 29 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1992 wrote to memory of 1344 1992 7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe 30 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31 PID 1108 wrote to memory of 988 1108 vbc.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe"C:\Users\Admin\AppData\Local\Temp\7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:988
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
C:\Program Files (x86)\BOOT\msnmsgr.exe"C:\Program Files (x86)\BOOT\msnmsgr.exe"3⤵
- Executes dropped EXE
PID:1264
-
-
-
C:\Users\Admin\AppData\Local\Temp\7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe"C:\Users\Admin\AppData\Local\Temp\7b91902e1732e68a968eada5bb219dbffa319899c7c09435e3090693260d77c9.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵PID:1344
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
Filesize
236KB
MD5f4b4d5e12e248fcd38e4d19d6a2f6de8
SHA1e4755580568a279d033badbe70ec74a118282914
SHA2565f64d8a67c42f227bcac19d4d341fd4bfcd10bdf2660e145fa8c316a7ff00fa3
SHA51210f72b11ed3c67991b726642cbd51ace2f66da738adfc77aaffe8fe41ae455a5682b2371b75eb4756f94a33f0f2fe8732a224fff5b16825932308a09468cd03f
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98