Analysis
-
max time kernel
152s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 09:31
Static task
static1
Behavioral task
behavioral1
Sample
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe
Resource
win7-20220812-en
General
-
Target
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe
-
Size
454KB
-
MD5
5b747bea00230414e196afd29ffd9cf7
-
SHA1
a1bff5c84bdb5895f693e7239735f93c81629c77
-
SHA256
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c
-
SHA512
18e004758d760a26641186dfd4ac8d140a131f59d77f29e02c0b9e120d64e1cca80e8d1f5675a92f44031fd6fc78de9648d9da14da8fd158fe15314ea8ba0bfa
-
SSDEEP
6144:FEYZenDUvNOYa+qmbjqsPGp3OJbsGynZO3ehp6k7+4Kgkw2D+QBOBw1VIfQFS2wx:Xen4vMJMqmeHZEepuw2apORD8
Malware Config
Extracted
cybergate
v1.18.0 - Crack Version
q
looost.no-ip.biz:90
K0672GC34DW2QD
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
explorer
-
install_file
explorer.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123
Signatures
-
Molebox Virtualization software 1 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule C:\Windows\explorer\explorer.exe molebox -
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\explorer\\explorer.exe" 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\explorer\\explorer.exe" 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y4B8154T-12QC-W8EP-5X24-2BRJ22F3T834} 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y4B8154T-12QC-W8EP-5X24-2BRJ22F3T834}\StubPath = "C:\\Windows\\explorer\\explorer.exe Restart" 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe -
Processes:
resource yara_rule behavioral1/memory/836-63-0x0000000010410000-0x0000000010482000-memory.dmp upx behavioral1/memory/836-69-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral1/memory/956-74-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral1/memory/956-75-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral1/memory/956-80-0x0000000010490000-0x0000000010502000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
Processes:
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exedescription ioc process File created C:\Windows\explorer\explorer.exe 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe File opened for modification C:\Windows\explorer\explorer.exe 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe File opened for modification C:\Windows\explorer\explorer.exe 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe File opened for modification C:\Windows\explorer\ 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exepid process 956 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exedescription pid process Token: SeBackupPrivilege 956 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe Token: SeRestorePrivilege 956 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe Token: SeDebugPrivilege 956 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe Token: SeDebugPrivilege 956 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exedescription pid process target process PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe PID 836 wrote to memory of 748 836 825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe"C:\Users\Admin\AppData\Local\Temp\825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe"C:\Users\Admin\AppData\Local\Temp\825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
236KB
MD52d5e4b1bf6e02021ab35c7e00ca84622
SHA1703bfb7a92a0d093fa1f8a9fba0bb783f42f8dec
SHA256fcc830275c5c3860dfc6a91dbc93a6b6d51cd6954a0fbcb6a6367a76a808453b
SHA5127600839db864321df3bba3f56962696e3d45652c45a6378f6b799a2cbd7925604d438701f01d3df852e8e56586255cf4ff9f110b4861dc1ba95025875c633e15
-
C:\Windows\explorer\explorer.exeFilesize
454KB
MD55b747bea00230414e196afd29ffd9cf7
SHA1a1bff5c84bdb5895f693e7239735f93c81629c77
SHA256825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c
SHA51218e004758d760a26641186dfd4ac8d140a131f59d77f29e02c0b9e120d64e1cca80e8d1f5675a92f44031fd6fc78de9648d9da14da8fd158fe15314ea8ba0bfa
-
memory/836-59-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/836-69-0x0000000010490000-0x0000000010502000-memory.dmpFilesize
456KB
-
memory/836-58-0x0000000001EC0000-0x0000000001FC0000-memory.dmpFilesize
1024KB
-
memory/836-54-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/836-60-0x0000000001D00000-0x0000000001E00000-memory.dmpFilesize
1024KB
-
memory/836-61-0x0000000002110000-0x0000000002210000-memory.dmpFilesize
1024KB
-
memory/836-63-0x0000000010410000-0x0000000010482000-memory.dmpFilesize
456KB
-
memory/836-79-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/836-78-0x0000000001BD0000-0x0000000001C1E000-memory.dmpFilesize
312KB
-
memory/836-57-0x0000000001EB1000-0x0000000001EB5000-memory.dmpFilesize
16KB
-
memory/836-55-0x0000000001BD0000-0x0000000001C1E000-memory.dmpFilesize
312KB
-
memory/836-56-0x0000000001CF1000-0x0000000001CF5000-memory.dmpFilesize
16KB
-
memory/956-75-0x0000000010490000-0x0000000010502000-memory.dmpFilesize
456KB
-
memory/956-74-0x0000000010490000-0x0000000010502000-memory.dmpFilesize
456KB
-
memory/956-72-0x0000000010490000-0x0000000010502000-memory.dmpFilesize
456KB
-
memory/956-68-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB
-
memory/956-67-0x0000000000000000-mapping.dmp
-
memory/956-80-0x0000000010490000-0x0000000010502000-memory.dmpFilesize
456KB