Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 15:59
Static task
static1
Behavioral task
behavioral1
Sample
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe
Resource
win7-20220901-en
General
-
Target
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe
-
Size
575KB
-
MD5
09dfa841a99ea12b8e963d0d11316aab
-
SHA1
e66b59521081536eb539279c4da561fe3eadfc7e
-
SHA256
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b
-
SHA512
6a27adf46a3b10fb8d3f31aea572ebc7bf116c5ebfa81aefe6a85a83ce2ff7e4678412b70fa2debf3c82cb0b7b89e61bedfcff2e8fd83db6b4cb20a73cd08545
-
SSDEEP
12288:ZaQBHFgW600JCwMvxNyQtt6Li/YaX5U16A617lhLxgZtQzcAvjC3//2K+dvZy5UL:Zlw631/qAjCPMZOUHR
Malware Config
Extracted
cybergate
v1.07.5
Hack
127.0.0.1:81
VD43DX8B8QF451
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Windir
-
install_file
svchsot.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Windir\\svchsot.exe" vbc.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Windir\\svchsot.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
svchsot.exepid process 468 svchsot.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
explorer.exevbc.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{45N25537-C3UX-VEB1-EV61-20248L7HQE3O} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{45N25537-C3UX-VEB1-EV61-20248L7HQE3O}\StubPath = "C:\\Windows\\system32\\Windir\\svchsot.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{45N25537-C3UX-VEB1-EV61-20248L7HQE3O} vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{45N25537-C3UX-VEB1-EV61-20248L7HQE3O}\StubPath = "C:\\Windows\\system32\\Windir\\svchsot.exe Restart" vbc.exe -
Processes:
resource yara_rule behavioral1/memory/1256-62-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral1/memory/1256-72-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1100-77-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1100-80-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1256-82-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral1/memory/1256-88-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/284-93-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/284-100-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/284-102-0x0000000010560000-0x00000000105C5000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 284 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 4 IoCs
Processes:
vbc.exevbc.exedescription ioc process File created C:\Windows\SysWOW64\Windir\svchsot.exe vbc.exe File opened for modification C:\Windows\SysWOW64\Windir\svchsot.exe vbc.exe File opened for modification C:\Windows\SysWOW64\Windir\svchsot.exe vbc.exe File opened for modification C:\Windows\SysWOW64\Windir\ vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exedescription pid process target process PID 1632 set thread context of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exevbc.exepid process 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe 1256 vbc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vbc.exepid process 284 vbc.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exeexplorer.exevbc.exedescription pid process Token: SeDebugPrivilege 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe Token: SeBackupPrivilege 1100 explorer.exe Token: SeRestorePrivilege 1100 explorer.exe Token: SeBackupPrivilege 284 vbc.exe Token: SeRestorePrivilege 284 vbc.exe Token: SeDebugPrivilege 284 vbc.exe Token: SeDebugPrivilege 284 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
vbc.exepid process 1256 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exevbc.exedescription pid process target process PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1632 wrote to memory of 1256 1632 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE PID 1256 wrote to memory of 1208 1256 vbc.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe"C:\Users\Admin\AppData\Local\Temp\f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Windir\svchsot.exe"C:\Windows\system32\Windir\svchsot.exe"5⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8803⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
224KB
MD55d8209a34c398845117d3a5fab40d99a
SHA1eca2d69f87f80a1d3de3161a23166a8a31198800
SHA2567be7d425a6fa279131706e28b06d2e1c03ef01806e6a9806c3e95b212e00aacf
SHA5120733dbfba77a589f16a9c3ab849fb7cdee2c56f52246548467d63bc24fc092c58eca44530e7f6b2b644bab6006c48789428abb82cbe6b2b2d1dd834abb3633d1
-
C:\Windows\SysWOW64\Windir\svchsot.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Windows\SysWOW64\Windir\svchsot.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Windows\SysWOW64\Windir\svchsot.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/284-102-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/284-100-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/284-93-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/284-86-0x0000000000000000-mapping.dmp
-
memory/468-98-0x0000000000000000-mapping.dmp
-
memory/1072-95-0x0000000000000000-mapping.dmp
-
memory/1100-80-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/1100-71-0x00000000721D1000-0x00000000721D3000-memory.dmpFilesize
8KB
-
memory/1100-77-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/1100-69-0x0000000000000000-mapping.dmp
-
memory/1208-65-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/1256-88-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/1256-82-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/1256-67-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1256-72-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/1256-94-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1256-62-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/1256-59-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1256-57-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1256-56-0x000000000040E1A8-mapping.dmp
-
memory/1256-55-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1632-60-0x0000000074F90000-0x000000007553B000-memory.dmpFilesize
5.7MB
-
memory/1632-101-0x0000000074F90000-0x000000007553B000-memory.dmpFilesize
5.7MB