Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    194s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 17:13

General

  • Target

    2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe

  • Size

    371KB

  • MD5

    0e2c1780f99d1c57f78f0484a173ec54

  • SHA1

    4d423db7595080e1a080145a642c1321720fb70a

  • SHA256

    2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f

  • SHA512

    60e109ef8b41429d191115bb36ffc09267d3e6b0664d5ebe4320b1b11548c5c2d4fdffb52906ba9d3a65d162b8f7800155df91d95bc360e93aeafacd7edae774

  • SSDEEP

    6144:XyH7xOc6H5c6HcT66vlmNxkpGYT6ZgWy5Rwj4Rg4jJusNnhEkcOw1KJjamBUd9OY:XaJJUy5RwjA/jgknhEklJvBzKH3

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

XAT INFECT

C2

xatkomokonline.no-ip.biz:88

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    matheuscs

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
    "C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
        "C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:964
        • C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
          C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
          4⤵
          • Adds policy Run key to start application
          • Executes dropped EXE
          • Modifies Installed Components in the registry
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1712
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            5⤵
            • Modifies Installed Components in the registry
            PID:524
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
              PID:1952
            • C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe
              "C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2008
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\system32\install\server.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:1992
                • C:\Windows\SysWOW64\install\server.exe
                  C:\Windows\SysWOW64\install\server.exe
                  7⤵
                  • Executes dropped EXE
                  PID:1748
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1272
      • C:\Windows\svchost.exe
        C:\Windows\svchost.exe
        1⤵
        • Executes dropped EXE
        PID:1704

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • C:\Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

        Filesize

        229KB

        MD5

        03515d22ecfc29db74f6300c38317a29

        SHA1

        84c35b02f1ea626142ecf1019f1b0a3e190b4538

        SHA256

        d6ad2c9e30ee5caa0b4a0660084c72a337136a565834b3ba8f10b194d6a2b3b4

        SHA512

        f2d2fbab01a0caf09bf0f36eeda3ba8a8336f287318db439f1a0426b97c59682d8eb9c46f9b5b9be1c79acd0b07b0d066c1bbaf8de79be687e7e62971bf9833a

      • C:\Windows\SysWOW64\install\server.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • C:\Windows\SysWOW64\install\server.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • C:\Windows\SysWOW64\install\server.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • C:\Windows\svchost.exe

        Filesize

        35KB

        MD5

        9e3c13b6556d5636b745d3e466d47467

        SHA1

        2ac1c19e268c49bc508f83fe3d20f495deb3e538

        SHA256

        20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

        SHA512

        5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

      • C:\Windows\svchost.exe

        Filesize

        35KB

        MD5

        9e3c13b6556d5636b745d3e466d47467

        SHA1

        2ac1c19e268c49bc508f83fe3d20f495deb3e538

        SHA256

        20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

        SHA512

        5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

      • C:\Windows\svchost.exe

        Filesize

        35KB

        MD5

        9e3c13b6556d5636b745d3e466d47467

        SHA1

        2ac1c19e268c49bc508f83fe3d20f495deb3e538

        SHA256

        20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

        SHA512

        5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

      • \Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • \Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • \Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • \Users\Admin\AppData\Local\Temp\2db5996a6f02f9d1fb515775ac92bcf335585a0971b29d513682cef60068581f.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • \Windows\SysWOW64\install\server.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • \Windows\SysWOW64\install\server.exe

        Filesize

        336KB

        MD5

        e3ae5ccc41b447e453e93377555d8bd9

        SHA1

        bda69338afb715f38e3d1f6770bbc27647f72ee7

        SHA256

        1b00ef0af784abdc8680cc11e43f1afbeb7b47b428ad13996d30444e445de29f

        SHA512

        0371e9773310dab9e2e3933d0ecd62709418fd1869616376fdfad9ff7e7cab2682b314fc8da5a4993154798ae3b1840ed62fb044ffebd97b7cdd540353611a60

      • memory/524-83-0x00000000746E1000-0x00000000746E3000-memory.dmp

        Filesize

        8KB

      • memory/524-92-0x0000000024080000-0x00000000240E2000-memory.dmp

        Filesize

        392KB

      • memory/524-89-0x0000000024080000-0x00000000240E2000-memory.dmp

        Filesize

        392KB

      • memory/1272-78-0x0000000024010000-0x0000000024072000-memory.dmp

        Filesize

        392KB

      • memory/1712-70-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/1712-94-0x00000000240F0000-0x0000000024152000-memory.dmp

        Filesize

        392KB

      • memory/1712-75-0x0000000024010000-0x0000000024072000-memory.dmp

        Filesize

        392KB

      • memory/1712-65-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/1712-73-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/1712-102-0x0000000024160000-0x00000000241C2000-memory.dmp

        Filesize

        392KB

      • memory/1712-108-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/1712-69-0x0000000074D61000-0x0000000074D63000-memory.dmp

        Filesize

        8KB

      • memory/1712-84-0x0000000024080000-0x00000000240E2000-memory.dmp

        Filesize

        392KB

      • memory/1712-72-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/1748-121-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/1748-122-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/1748-123-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/1748-124-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/2008-109-0x0000000024160000-0x00000000241C2000-memory.dmp

        Filesize

        392KB

      • memory/2008-107-0x0000000024160000-0x00000000241C2000-memory.dmp

        Filesize

        392KB

      • memory/2008-125-0x0000000024160000-0x00000000241C2000-memory.dmp

        Filesize

        392KB