Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe
Resource
win10v2004-20220812-en
General
-
Target
0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe
-
Size
302KB
-
MD5
02b1764a2c46cda0f65015dc621db112
-
SHA1
95a089cb1db571df33f3e3728e32b7cb3ec93da0
-
SHA256
0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3
-
SHA512
f3a78cb3d8b46560a486f3409a2461fe6a55040f3bab1413d078b8854fc5ec3b5019ca2f232a97a014af2fdb14e6d144635ced0b0b7c57fc97283195be236443
-
SSDEEP
6144:h6RWbbK3cZHuCszYGhzx9jElwaZWyASXVDccUOnE3R6MWVqD4BfS:g6Ys7s/xWwyWyxITOyVkq0ZS
Malware Config
Extracted
cybergate
v1.07.5
micheal
mic12.no-ip.biz:1919
QAW347TV1I74C2
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1996 svchost.exe 1688 svchost.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{XXKQVLI3-316E-75M1-KUBT-6RD5332SBBSR} 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{XXKQVLI3-316E-75M1-KUBT-6RD5332SBBSR}\StubPath = "C:\\Program Files (x86)\\install\\svchost.exe Restart" 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe -
resource yara_rule behavioral1/memory/836-71-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral1/memory/836-77-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1060-82-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1060-107-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1060-109-0x0000000010480000-0x00000000104E5000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1060 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 1060 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1840 set thread context of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1996 set thread context of 1688 1996 svchost.exe 31 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\install\svchost.exe 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe File opened for modification C:\Program Files (x86)\install\svchost.exe 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1060 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 1060 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe Token: SeRestorePrivilege 1060 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe Token: SeDebugPrivilege 1060 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe Token: SeDebugPrivilege 1060 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 1840 wrote to memory of 836 1840 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 27 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28 PID 836 wrote to memory of 840 836 0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe"C:\Users\Admin\AppData\Local\Temp\0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe"C:\Users\Admin\AppData\Local\Temp\0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe"2⤵
- Modifies Installed Components in the registry
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe"C:\Users\Admin\AppData\Local\Temp\0b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1060 -
C:\Program Files (x86)\install\svchost.exe"C:\Program Files (x86)\install\svchost.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1996 -
C:\Program Files (x86)\install\svchost.exe"C:\Program Files (x86)\install\svchost.exe"5⤵
- Executes dropped EXE
PID:1688
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302KB
MD502b1764a2c46cda0f65015dc621db112
SHA195a089cb1db571df33f3e3728e32b7cb3ec93da0
SHA2560b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3
SHA512f3a78cb3d8b46560a486f3409a2461fe6a55040f3bab1413d078b8854fc5ec3b5019ca2f232a97a014af2fdb14e6d144635ced0b0b7c57fc97283195be236443
-
Filesize
302KB
MD502b1764a2c46cda0f65015dc621db112
SHA195a089cb1db571df33f3e3728e32b7cb3ec93da0
SHA2560b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3
SHA512f3a78cb3d8b46560a486f3409a2461fe6a55040f3bab1413d078b8854fc5ec3b5019ca2f232a97a014af2fdb14e6d144635ced0b0b7c57fc97283195be236443
-
Filesize
302KB
MD502b1764a2c46cda0f65015dc621db112
SHA195a089cb1db571df33f3e3728e32b7cb3ec93da0
SHA2560b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3
SHA512f3a78cb3d8b46560a486f3409a2461fe6a55040f3bab1413d078b8854fc5ec3b5019ca2f232a97a014af2fdb14e6d144635ced0b0b7c57fc97283195be236443
-
Filesize
224KB
MD574e9f339ff1c390130678cf9321ea427
SHA1e11ce331b45ddd896f33ba23789ac1df9d96d3e9
SHA256191c40c8ccee100e3d9feb9f92bdca70b87f63437ac6fe6a05ed4a214102a60a
SHA512fd7cb36e3883111fb10f1692ff2bbdb0b82aa492b0beb09d021d0865db294f0ae7835be70d219b383c0925d1f8b5899bbd967afaf3a7ae2d4e3c961c08e6d566
-
Filesize
302KB
MD502b1764a2c46cda0f65015dc621db112
SHA195a089cb1db571df33f3e3728e32b7cb3ec93da0
SHA2560b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3
SHA512f3a78cb3d8b46560a486f3409a2461fe6a55040f3bab1413d078b8854fc5ec3b5019ca2f232a97a014af2fdb14e6d144635ced0b0b7c57fc97283195be236443
-
Filesize
302KB
MD502b1764a2c46cda0f65015dc621db112
SHA195a089cb1db571df33f3e3728e32b7cb3ec93da0
SHA2560b53aab294a594e061cdcc8572c5caeebd2ebda33c66f7e79f3be372a57dbfb3
SHA512f3a78cb3d8b46560a486f3409a2461fe6a55040f3bab1413d078b8854fc5ec3b5019ca2f232a97a014af2fdb14e6d144635ced0b0b7c57fc97283195be236443