Analysis

  • max time kernel
    154s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 21:53

General

  • Target

    7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

  • Size

    353KB

  • MD5

    915e965cb39c9c14b553ad75aa942307

  • SHA1

    f3a64c310371e3df7384814d870157847c0b9202

  • SHA256

    7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98

  • SHA512

    5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

  • SSDEEP

    6144:ck4qmmSI9XinMT7eUzbp5mbBJLUg/aUeU7QDPoNRQC9FQWG9Jn/YaobCIKP:v9RFinMXLAnojUeOQC9Sln/YaBP

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

dsd3tec.zapto.org:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    t?tulo da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Modifies firewall policy service 2 TTPs 9 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 3 IoCs
  • Windows security bypass 2 TTPs 18 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 3 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:476
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:460
        • C:\Windows\system32\sppsvc.exe
          C:\Windows\system32\sppsvc.exe
          2⤵
            PID:1056
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
            2⤵
              PID:680
            • C:\Windows\system32\taskhost.exe
              "taskhost.exe"
              2⤵
                PID:1128
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                2⤵
                  PID:1080
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  2⤵
                    PID:972
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k NetworkService
                    2⤵
                      PID:272
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs
                      2⤵
                        PID:884
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService
                        2⤵
                          PID:844
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          2⤵
                            PID:812
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                            2⤵
                              PID:744
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k RPCSS
                              2⤵
                                PID:664
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k DcomLaunch
                                2⤵
                                  PID:584
                                  • C:\Windows\system32\DllHost.exe
                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                    3⤵
                                      PID:948
                                    • C:\Windows\system32\DllHost.exe
                                      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                      3⤵
                                        PID:1920
                                      • C:\Windows\system32\DllHost.exe
                                        C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                        3⤵
                                          PID:1524
                                    • C:\Windows\system32\winlogon.exe
                                      winlogon.exe
                                      1⤵
                                        PID:416
                                      • C:\Windows\system32\csrss.exe
                                        %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                        1⤵
                                          PID:380
                                        • C:\Windows\system32\wininit.exe
                                          wininit.exe
                                          1⤵
                                            PID:368
                                            • C:\Windows\system32\lsm.exe
                                              C:\Windows\system32\lsm.exe
                                              2⤵
                                                PID:484
                                            • C:\Windows\system32\csrss.exe
                                              %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                              1⤵
                                                PID:332
                                              • C:\Windows\System32\smss.exe
                                                \SystemRoot\System32\smss.exe
                                                1⤵
                                                  PID:260
                                                • C:\Windows\system32\wbem\wmiprvse.exe
                                                  C:\Windows\system32\wbem\wmiprvse.exe
                                                  1⤵
                                                    PID:2036
                                                  • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                                                    wmiadap.exe /F /T /R
                                                    1⤵
                                                      PID:1992
                                                    • C:\Windows\Explorer.EXE
                                                      C:\Windows\Explorer.EXE
                                                      1⤵
                                                        PID:1244
                                                        • C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe"
                                                          2⤵
                                                          • Modifies firewall policy service
                                                          • UAC bypass
                                                          • Windows security bypass
                                                          • Adds policy Run key to start application
                                                          • Modifies Installed Components in the registry
                                                          • Loads dropped DLL
                                                          • Windows security modification
                                                          • Checks whether UAC is enabled
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of WriteProcessMemory
                                                          • System policy modification
                                                          PID:1664
                                                          • C:\Windows\SysWOW64\explorer.exe
                                                            explorer.exe
                                                            3⤵
                                                            • Modifies firewall policy service
                                                            • UAC bypass
                                                            • Windows security bypass
                                                            • Modifies Installed Components in the registry
                                                            • Enumerates connected drives
                                                            • Drops autorun.inf file
                                                            • Drops file in Program Files directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1744
                                                          • C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Drops file in System32 directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:896
                                                            • C:\windows\SysWOW64\microsoft\windows.exe
                                                              "C:\windows\system32\microsoft\windows.exe"
                                                              4⤵
                                                              • Modifies firewall policy service
                                                              • UAC bypass
                                                              • Windows security bypass
                                                              • Executes dropped EXE
                                                              • Windows security modification
                                                              • Checks whether UAC is enabled
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • System policy modification
                                                              PID:992
                                                      • C:\Windows\system32\Dwm.exe
                                                        "C:\Windows\system32\Dwm.exe"
                                                        1⤵
                                                          PID:1188

                                                        Network

                                                              MITRE ATT&CK Enterprise v6

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

                                                                Filesize

                                                                353KB

                                                                MD5

                                                                915e965cb39c9c14b553ad75aa942307

                                                                SHA1

                                                                f3a64c310371e3df7384814d870157847c0b9202

                                                                SHA256

                                                                7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98

                                                                SHA512

                                                                5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

                                                              • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

                                                                Filesize

                                                                240KB

                                                                MD5

                                                                0f2e0e5a1878d0e5b150315bda03b2ca

                                                                SHA1

                                                                ec54908e4cef8b6be4336e009489e77b87d9a390

                                                                SHA256

                                                                937e46996cc91965b9316ff56ca8d72c97378cb2801c250dc1b1db4668c4281e

                                                                SHA512

                                                                d77dd735fb71238a730a5feabf4984511e3a656f0cf2980c4f563ed755cd525c7808c74e908bd1dee8e65ed2364714b961b37f8db403d1a444d067cf74648859

                                                              • C:\Windows\SYSTEM.INI

                                                                Filesize

                                                                255B

                                                                MD5

                                                                490eb34aab2ccedd6dde230ea0cdc326

                                                                SHA1

                                                                c92511652c49230cae38634a8e04147baa9dd8f2

                                                                SHA256

                                                                8ead14fa7da41c149b088db25097dd2062ffb298508964941152666898f2032c

                                                                SHA512

                                                                481f8523de47c27093f7cadc027ed0226f5ed866018ddfde3340730d849e0023bc217c949c35db1f3b94c63c0118fc1b0c611f0028e4be9075db07e869a3e5c3

                                                              • C:\Windows\SysWOW64\microsoft\windows.exe

                                                                Filesize

                                                                353KB

                                                                MD5

                                                                915e965cb39c9c14b553ad75aa942307

                                                                SHA1

                                                                f3a64c310371e3df7384814d870157847c0b9202

                                                                SHA256

                                                                7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98

                                                                SHA512

                                                                5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

                                                              • \??\c:\windows\SysWOW64\microsoft\windows.exe

                                                                Filesize

                                                                353KB

                                                                MD5

                                                                915e965cb39c9c14b553ad75aa942307

                                                                SHA1

                                                                f3a64c310371e3df7384814d870157847c0b9202

                                                                SHA256

                                                                7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98

                                                                SHA512

                                                                5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

                                                              • \Users\Admin\AppData\Local\Temp\7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98.exe

                                                                Filesize

                                                                353KB

                                                                MD5

                                                                915e965cb39c9c14b553ad75aa942307

                                                                SHA1

                                                                f3a64c310371e3df7384814d870157847c0b9202

                                                                SHA256

                                                                7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98

                                                                SHA512

                                                                5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

                                                              • \Windows\SysWOW64\microsoft\windows.exe

                                                                Filesize

                                                                353KB

                                                                MD5

                                                                915e965cb39c9c14b553ad75aa942307

                                                                SHA1

                                                                f3a64c310371e3df7384814d870157847c0b9202

                                                                SHA256

                                                                7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98

                                                                SHA512

                                                                5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

                                                              • \Windows\SysWOW64\microsoft\windows.exe

                                                                Filesize

                                                                353KB

                                                                MD5

                                                                915e965cb39c9c14b553ad75aa942307

                                                                SHA1

                                                                f3a64c310371e3df7384814d870157847c0b9202

                                                                SHA256

                                                                7a4a760a071d0b05c85351d4c63fd1deee9d139c96f6e6b5c58f3065353ded98

                                                                SHA512

                                                                5ea6a3252a488ed0c2e548be7a7a9e850b36875e2194c5de0519272edebaad2ef699ccf6a6cedd9b5cea9ff42184a73dcc0cb78a71a92b1b5b3f27884e83b9aa

                                                              • memory/260-93-0x0000000031770000-0x000000003177D000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/896-151-0x0000000005B00000-0x0000000005B6A000-memory.dmp

                                                                Filesize

                                                                424KB

                                                              • memory/896-91-0x00000000240F0000-0x0000000024152000-memory.dmp

                                                                Filesize

                                                                392KB

                                                              • memory/896-110-0x00000000240F0000-0x0000000024152000-memory.dmp

                                                                Filesize

                                                                392KB

                                                              • memory/896-165-0x00000000049E0000-0x00000000049E2000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/896-162-0x00000000240F0000-0x0000000024152000-memory.dmp

                                                                Filesize

                                                                392KB

                                                              • memory/896-155-0x00000000049E0000-0x00000000049E2000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/992-157-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                Filesize

                                                                424KB

                                                              • memory/992-158-0x0000000001F30000-0x0000000002FBE000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                              • memory/992-152-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                Filesize

                                                                424KB

                                                              • memory/992-156-0x00000000003D0000-0x00000000003D2000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/992-153-0x0000000001F30000-0x0000000002FBE000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                              • memory/1244-63-0x0000000024010000-0x0000000024072000-memory.dmp

                                                                Filesize

                                                                392KB

                                                              • memory/1664-94-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                              • memory/1664-60-0x0000000024010000-0x0000000024072000-memory.dmp

                                                                Filesize

                                                                392KB

                                                              • memory/1664-86-0x00000000240F0000-0x0000000024152000-memory.dmp

                                                                Filesize

                                                                392KB

                                                              • memory/1664-92-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                Filesize

                                                                424KB

                                                              • memory/1664-55-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                Filesize

                                                                424KB

                                                              • memory/1664-54-0x0000000076181000-0x0000000076183000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/1664-56-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                              • memory/1664-69-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                                Filesize

                                                                392KB

                                                              • memory/1664-57-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                              • memory/1664-58-0x0000000000290000-0x0000000000292000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/1744-74-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                                Filesize

                                                                392KB

                                                              • memory/1744-154-0x0000000003B80000-0x0000000003B82000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/1744-68-0x0000000075331000-0x0000000075333000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/1744-159-0x00000000041D0000-0x000000000525E000-memory.dmp

                                                                Filesize

                                                                16.6MB

                                                              • memory/1744-150-0x00000000318F0000-0x00000000318FD000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/1744-163-0x00000000318F0000-0x00000000318FD000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/1744-164-0x0000000003B80000-0x0000000003B82000-memory.dmp

                                                                Filesize

                                                                8KB

                                                              • memory/1744-77-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                                Filesize

                                                                392KB

                                                              • memory/1744-166-0x00000000041D0000-0x000000000525E000-memory.dmp

                                                                Filesize

                                                                16.6MB