Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 19:34
Static task
static1
Behavioral task
behavioral1
Sample
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe
Resource
win10v2004-20220901-en
General
-
Target
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe
-
Size
311KB
-
MD5
a1ae6ded263b40837f428992c07edfdf
-
SHA1
88b2e10d50d28347b177520f568f5cac1e232f13
-
SHA256
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4
-
SHA512
a755c09cbf241a67b5c722f8486684ecbfbaa8c2503a6dce86514b6306de2968c8a785bb68d2b92cc08c96a06c1b4ae1c0432578b6388d277a17696f6c5574a1
-
SSDEEP
6144:YbjEwsj2WEVIAcKWY3odLteaoV+oqtZGTbv18XgwAnsvNu6aRA1:YJsjaezDp8Yoc+98XunsU6f
Malware Config
Extracted
cybergate
2.6
rrrrrrrrrrrrrrrrrrrr
127.0.0.1:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
sssssssssssssss
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
t?tulo da mensagem
-
password
abcd1234
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\sssssssssssssss\\windows.exe" cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\sssssssssssssss\\windows.exe" cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe -
Executes dropped EXE 2 IoCs
pid Process 1532 windows.exe 4560 windows.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "C:\\Program Files (x86)\\sssssssssssssss\\windows.exe Restart" cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "C:\\Program Files (x86)\\sssssssssssssss\\windows.exe" explorer.exe -
resource yara_rule behavioral2/memory/4924-140-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/4924-145-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/364-148-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/364-151-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/4924-154-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/3860-157-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/3860-159-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/3860-170-0x00000000240F0000-0x0000000024152000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4152 set thread context of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 1532 set thread context of 4560 1532 windows.exe 87 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\sssssssssssssss\windows.exe cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe File opened for modification C:\Program Files (x86)\sssssssssssssss\windows.exe cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2348 4560 WerFault.exe 87 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3860 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3860 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe Token: SeDebugPrivilege 3860 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 1532 windows.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4152 wrote to memory of 4924 4152 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 81 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39 PID 4924 wrote to memory of 2640 4924 cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe 39
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe"C:\Users\Admin\AppData\Local\Temp\cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exeC:\Users\Admin\AppData\Local\Temp\cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
PID:364
-
-
C:\Users\Admin\AppData\Local\Temp\cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe"C:\Users\Admin\AppData\Local\Temp\cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe"4⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3860 -
C:\Program Files (x86)\sssssssssssssss\windows.exe"C:\Program Files (x86)\sssssssssssssss\windows.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1532 -
C:\Program Files (x86)\sssssssssssssss\windows.exe"C:\Program Files (x86)\sssssssssssssss\windows.exe"6⤵
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 5447⤵
- Program crash
PID:2348
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4560 -ip 45601⤵PID:572
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
311KB
MD5a1ae6ded263b40837f428992c07edfdf
SHA188b2e10d50d28347b177520f568f5cac1e232f13
SHA256cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4
SHA512a755c09cbf241a67b5c722f8486684ecbfbaa8c2503a6dce86514b6306de2968c8a785bb68d2b92cc08c96a06c1b4ae1c0432578b6388d277a17696f6c5574a1
-
Filesize
311KB
MD5a1ae6ded263b40837f428992c07edfdf
SHA188b2e10d50d28347b177520f568f5cac1e232f13
SHA256cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4
SHA512a755c09cbf241a67b5c722f8486684ecbfbaa8c2503a6dce86514b6306de2968c8a785bb68d2b92cc08c96a06c1b4ae1c0432578b6388d277a17696f6c5574a1
-
Filesize
311KB
MD5a1ae6ded263b40837f428992c07edfdf
SHA188b2e10d50d28347b177520f568f5cac1e232f13
SHA256cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4
SHA512a755c09cbf241a67b5c722f8486684ecbfbaa8c2503a6dce86514b6306de2968c8a785bb68d2b92cc08c96a06c1b4ae1c0432578b6388d277a17696f6c5574a1
-
Filesize
229KB
MD55be8bae4d399935f088e57d3befeaf28
SHA1965463d4f1ffe89ee82197b96ac9daa1b5b70d69
SHA256f71ae20887476c5252ed9fe0b65f602e67af80bb3fc1880839c6040745795818
SHA512a274ab7e16a294558e1c5104eb0a114feb3c0928f556bf68de01f616790149b71fd003348d86a013c6adbe5ae95348a2ae423dffb018b210cf7f007e3616290c