Analysis
-
max time kernel
304s -
max time network
314s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 15:59
Static task
static1
Behavioral task
behavioral1
Sample
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe
Resource
win7-20220901-en
General
-
Target
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe
-
Size
575KB
-
MD5
09dfa841a99ea12b8e963d0d11316aab
-
SHA1
e66b59521081536eb539279c4da561fe3eadfc7e
-
SHA256
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b
-
SHA512
6a27adf46a3b10fb8d3f31aea572ebc7bf116c5ebfa81aefe6a85a83ce2ff7e4678412b70fa2debf3c82cb0b7b89e61bedfcff2e8fd83db6b4cb20a73cd08545
-
SSDEEP
12288:ZaQBHFgW600JCwMvxNyQtt6Li/YaX5U16A617lhLxgZtQzcAvjC3//2K+dvZy5UL:Zlw631/qAjCPMZOUHR
Malware Config
Extracted
cybergate
v1.07.5
Hack
127.0.0.1:81
VD43DX8B8QF451
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Windir
-
install_file
svchsot.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Windir\\svchsot.exe" vbc.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Windir\\svchsot.exe" vbc.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
vbc.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45N25537-C3UX-VEB1-EV61-20248L7HQE3O}\StubPath = "C:\\Windows\\system32\\Windir\\svchsot.exe Restart" vbc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{45N25537-C3UX-VEB1-EV61-20248L7HQE3O} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45N25537-C3UX-VEB1-EV61-20248L7HQE3O}\StubPath = "C:\\Windows\\system32\\Windir\\svchsot.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{45N25537-C3UX-VEB1-EV61-20248L7HQE3O} vbc.exe -
Processes:
resource yara_rule behavioral2/memory/4388-141-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/4388-146-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/2692-149-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/2692-150-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/4388-154-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral2/memory/2692-160-0x0000000010480000-0x00000000104E5000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
vbc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Windir\svchsot.exe vbc.exe File created C:\Windows\SysWOW64\Windir\svchsot.exe vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exedescription pid process target process PID 3200 set thread context of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe -
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exevbc.exepid process 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe 4388 vbc.exe 4388 vbc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exeexplorer.exedw20.exedescription pid process Token: SeDebugPrivilege 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe Token: SeBackupPrivilege 2692 explorer.exe Token: SeRestorePrivilege 2692 explorer.exe Token: SeRestorePrivilege 1732 dw20.exe Token: SeBackupPrivilege 1732 dw20.exe Token: SeBackupPrivilege 1732 dw20.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
vbc.exepid process 4388 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exevbc.exedescription pid process target process PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 3200 wrote to memory of 4388 3200 f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe vbc.exe PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE PID 4388 wrote to memory of 2468 4388 vbc.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe"C:\Users\Admin\AppData\Local\Temp\f81a720ff5018e33e4bf3c54e2351fe8b76fed77be3dade613430f39e1acb02b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 14643⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
224KB
MD55d8209a34c398845117d3a5fab40d99a
SHA1eca2d69f87f80a1d3de3161a23166a8a31198800
SHA2567be7d425a6fa279131706e28b06d2e1c03ef01806e6a9806c3e95b212e00aacf
SHA5120733dbfba77a589f16a9c3ab849fb7cdee2c56f52246548467d63bc24fc092c58eca44530e7f6b2b644bab6006c48789428abb82cbe6b2b2d1dd834abb3633d1
-
C:\Windows\SysWOW64\Windir\svchsot.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/1732-155-0x0000000000000000-mapping.dmp
-
memory/2692-149-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/2692-160-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/2692-150-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/2692-145-0x0000000000000000-mapping.dmp
-
memory/3120-159-0x0000000000000000-mapping.dmp
-
memory/3200-132-0x0000000074A50000-0x0000000075001000-memory.dmpFilesize
5.7MB
-
memory/3200-138-0x0000000074A50000-0x0000000075001000-memory.dmpFilesize
5.7MB
-
memory/4388-136-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4388-146-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/4388-141-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/4388-139-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4388-137-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4388-135-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4388-154-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/4388-134-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4388-133-0x0000000000000000-mapping.dmp