Analysis
-
max time kernel
157s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:34
Static task
static1
Behavioral task
behavioral1
Sample
81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe
Resource
win7-20220812-en
General
-
Target
81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe
-
Size
407KB
-
MD5
92ab6f3425debea9bc52f6258c8c24d4
-
SHA1
4dac2076593202265b323dc95225282c22893c78
-
SHA256
81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0
-
SHA512
a0f7e300cc657396dc1b78a8f5b1d27a56b63f638753dd1293be3ae6fe60fcf294bd32c75ed82811115d1912e267ddd546a1ca2c527283fd5cea20b1133cb284
-
SSDEEP
6144:b5Apma3f4in830cZEpwmeoqf4Z0XYI9FsMJRt:b5a3wi8KwmeoqwZM0MF
Malware Config
Extracted
cybergate
2.6
vítima
127.0.0.1:81
***MUTX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
dllregedit
-
install_file
regeditregister.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
mypass
-
regkey_hkcu
HKCUz
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
Stub.exe1.exe1.exe1.exeregeditregister.exeregeditregister.exepid process 2708 Stub.exe 1388 1.exe 3008 1.exe 3692 1.exe 4136 regeditregister.exe 3448 regeditregister.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
1.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EH42JVF-048Q-HU2B-4FN5-D704254VWEUO} 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EH42JVF-048Q-HU2B-4FN5-D704254VWEUO}\StubPath = "C:\\Windows\\system32\\dllregedit\\regeditregister.exe Restart" 1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EH42JVF-048Q-HU2B-4FN5-D704254VWEUO} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EH42JVF-048Q-HU2B-4FN5-D704254VWEUO}\StubPath = "C:\\Windows\\system32\\dllregedit\\regeditregister.exe" explorer.exe -
Processes:
resource yara_rule behavioral2/memory/3008-143-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3008-146-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3008-147-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3008-148-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3008-150-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/3008-155-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/1732-158-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/1732-161-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3008-163-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/3008-169-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/3692-173-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/3008-172-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3692-182-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/3448-183-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3448-184-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3448-185-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3692-186-0x0000000024160000-0x00000000241C2000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCUz = "C:\\Windows\\system32\\dllregedit\\regeditregister.exe" 1.exe -
Drops file in System32 directory 3 IoCs
Processes:
1.exeregeditregister.exedescription ioc process File created C:\Windows\SysWOW64\dllregedit\regeditregister.exe 1.exe File opened for modification C:\Windows\SysWOW64\dllregedit\regeditregister.exe 1.exe File opened for modification C:\Windows\SysWOW64\dllregedit\regeditregister.exe regeditregister.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1.exeregeditregister.exedescription pid process target process PID 1388 set thread context of 3008 1388 1.exe 1.exe PID 4136 set thread context of 3448 4136 regeditregister.exe regeditregister.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1576 3448 WerFault.exe regeditregister.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1.exepid process 3008 1.exe 3008 1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
1.exepid process 3692 1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1.exedescription pid process Token: SeDebugPrivilege 3692 1.exe Token: SeDebugPrivilege 3692 1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
1.exepid process 3008 1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1.exeregeditregister.exepid process 1388 1.exe 4136 regeditregister.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe1.exe1.exedescription pid process target process PID 4720 wrote to memory of 2708 4720 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe Stub.exe PID 4720 wrote to memory of 2708 4720 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe Stub.exe PID 4720 wrote to memory of 1388 4720 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe 1.exe PID 4720 wrote to memory of 1388 4720 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe 1.exe PID 4720 wrote to memory of 1388 4720 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe 1.exe PID 1388 wrote to memory of 3008 1388 1.exe 1.exe PID 1388 wrote to memory of 3008 1388 1.exe 1.exe PID 1388 wrote to memory of 3008 1388 1.exe 1.exe PID 1388 wrote to memory of 3008 1388 1.exe 1.exe PID 1388 wrote to memory of 3008 1388 1.exe 1.exe PID 1388 wrote to memory of 3008 1388 1.exe 1.exe PID 1388 wrote to memory of 3008 1388 1.exe 1.exe PID 1388 wrote to memory of 3008 1388 1.exe 1.exe PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE PID 3008 wrote to memory of 700 3008 1.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe"C:\Users\Admin\AppData\Local\Temp\81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.exeC:\Users\Admin\AppData\Local\Temp\1.exe4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
- Modifies Installed Components in the registry
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exe"C:\Windows\system32\dllregedit\regeditregister.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exeC:\Windows\SysWOW64\dllregedit\regeditregister.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 5648⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3448 -ip 34481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Users\Admin\AppData\Local\Temp\Stub.exeFilesize
15KB
MD59f0923f8db9e61c4ca6a7163c2ecd35c
SHA1809f07b4102589adda53341606d470e01d2b1562
SHA25661e333deb690adb92183f5bc499a94b550250ee45b3a0246c6a53ce53c7a2ff8
SHA5123a0b4d0b3905d5a1512d48e9e2f4bf9e37eae716ca918b97c9d13ce41b939b48d7271e30d4efe4e36be7b8762dd44ba6a96fd81f0211a66062e3e31bf384e9ad
-
C:\Users\Admin\AppData\Local\Temp\Stub.exeFilesize
15KB
MD59f0923f8db9e61c4ca6a7163c2ecd35c
SHA1809f07b4102589adda53341606d470e01d2b1562
SHA25661e333deb690adb92183f5bc499a94b550250ee45b3a0246c6a53ce53c7a2ff8
SHA5123a0b4d0b3905d5a1512d48e9e2f4bf9e37eae716ca918b97c9d13ce41b939b48d7271e30d4efe4e36be7b8762dd44ba6a96fd81f0211a66062e3e31bf384e9ad
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD5219ddb633aed74f1b3c429dfcbad1113
SHA1e785be485bf92c416e72dfa75c7771e369870731
SHA2569c3cd12580bd029876f5434999901558750ecde4e9448910afaee570262856d2
SHA512c2f4236ece3d6c4801ee6e68be95a03793fac34d0ca2acd74e743af12858a8938aa8f6db9756d33b4cee5b42e9fdf8ded1e8502e0ccb526b56ea6af49b0eddfe
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
memory/1388-137-0x0000000000000000-mapping.dmp
-
memory/1732-161-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1732-158-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1732-154-0x0000000000000000-mapping.dmp
-
memory/2708-136-0x00007FFE4D6F0000-0x00007FFE4E126000-memory.dmpFilesize
10.2MB
-
memory/2708-133-0x0000000000000000-mapping.dmp
-
memory/3008-143-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3008-172-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3008-150-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/3008-148-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3008-147-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3008-163-0x00000000240F0000-0x0000000024152000-memory.dmpFilesize
392KB
-
memory/3008-142-0x0000000000000000-mapping.dmp
-
memory/3008-146-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3008-169-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/3008-155-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/3448-178-0x0000000000000000-mapping.dmp
-
memory/3448-183-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3448-184-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3448-185-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3692-173-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/3692-167-0x0000000000000000-mapping.dmp
-
memory/3692-182-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/3692-186-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/4136-174-0x0000000000000000-mapping.dmp
-
memory/4720-132-0x00007FFE4D6F0000-0x00007FFE4E126000-memory.dmpFilesize
10.2MB