Analysis
-
max time kernel
271s -
max time network
315s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 16:23
Behavioral task
behavioral1
Sample
9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe
Resource
win7-20220812-en
General
-
Target
9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe
-
Size
428KB
-
MD5
a3f2060a032f5c0384a39abf114b7811
-
SHA1
e486eabb1068ec658ff8a183fce42e5a1803c327
-
SHA256
9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3
-
SHA512
c736bcff0839006d981b3479b365e1f4ae8628dbdcce92500dd54ed5b19147a452287b4bfab0858cf168f76b68f5577055251da06a4d8da9e460514b820dffbe
-
SSDEEP
12288:xuMwaBi8vvrHxVPKyG2m77sZB07FxObO32H:xHwT8vrxA2t07FQac
Malware Config
Extracted
cybergate
v3.4.2.2
1
s.myftp.org:80
0Q1U5P26776M3L
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
wbem
-
install_file
wbem.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
The program can't start because MSVCR100.dll is missing from your computer. Try reinstalling the program to fix this problem.
-
message_box_title
System Error
-
password
2326
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\wbem\\wbem.exe" 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\wbem\\wbem.exe" 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
explorer.exe9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0Y88G0S-2RJL-CPP7-F62V-JFRD876R0843} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0Y88G0S-2RJL-CPP7-F62V-JFRD876R0843}\StubPath = "C:\\Windows\\system32\\wbem\\wbem.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0Y88G0S-2RJL-CPP7-F62V-JFRD876R0843} 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0Y88G0S-2RJL-CPP7-F62V-JFRD876R0843}\StubPath = "C:\\Windows\\system32\\wbem\\wbem.exe Restart" 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe -
Processes:
resource yara_rule behavioral2/memory/3764-133-0x0000000010410000-0x0000000010480000-memory.dmp upx behavioral2/memory/3764-138-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral2/memory/3688-141-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral2/memory/3688-144-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral2/memory/3764-147-0x00000000104F0000-0x0000000010560000-memory.dmp upx behavioral2/memory/2084-150-0x00000000104F0000-0x0000000010560000-memory.dmp upx behavioral2/memory/2084-151-0x00000000104F0000-0x0000000010560000-memory.dmp upx behavioral2/memory/2084-152-0x00000000104F0000-0x0000000010560000-memory.dmp upx -
Drops startup file 3 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wbem.exe explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wbem.exe explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\wbem\\wbem.exe" 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\wbem\\wbem.exe" 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe -
Drops file in System32 directory 4 IoCs
Processes:
9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exeexplorer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wbem\wbem.exe 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe File opened for modification C:\Windows\SysWOW64\wbem\wbem.exe explorer.exe File opened for modification C:\Windows\SysWOW64\wbem\ explorer.exe File created C:\Windows\SysWOW64\wbem\wbem.exe 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exepid process 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
explorer.exedescription pid process Token: SeDebugPrivilege 2084 explorer.exe Token: SeDebugPrivilege 2084 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exepid process 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exedescription pid process target process PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE PID 3764 wrote to memory of 676 3764 9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe"C:\Users\Admin\AppData\Local\Temp\9869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies Installed Components in the registry
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Drops startup file
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
385KB
MD5e40bc963283bbeb57d4a8d4b1db4c9ee
SHA1f83b334522dbe8782d881d1eb95c6a0f50972d82
SHA25674d8e485395d5d72c9b442591f6944fe5a0b4a15c147ac4f3f5fd578dd69c25b
SHA51221b037eb44e9c5f2d9eb4dab4e3dd0a85118edcbbd528fa28ff72e808abf872f2535ef03c5be007275734c471397d8a05dae6e016f8d1ca762ccd904805344b5
-
C:\Windows\SysWOW64\wbem\wbem.exeFilesize
428KB
MD5a3f2060a032f5c0384a39abf114b7811
SHA1e486eabb1068ec658ff8a183fce42e5a1803c327
SHA2569869c406bc9ae152474da5fc83049eb47e434b4937b42e9ca7348e2100f2bab3
SHA512c736bcff0839006d981b3479b365e1f4ae8628dbdcce92500dd54ed5b19147a452287b4bfab0858cf168f76b68f5577055251da06a4d8da9e460514b820dffbe
-
memory/2084-146-0x0000000000000000-mapping.dmp
-
memory/2084-150-0x00000000104F0000-0x0000000010560000-memory.dmpFilesize
448KB
-
memory/2084-151-0x00000000104F0000-0x0000000010560000-memory.dmpFilesize
448KB
-
memory/2084-152-0x00000000104F0000-0x0000000010560000-memory.dmpFilesize
448KB
-
memory/3688-137-0x0000000000000000-mapping.dmp
-
memory/3688-141-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/3688-144-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/3764-133-0x0000000010410000-0x0000000010480000-memory.dmpFilesize
448KB
-
memory/3764-138-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/3764-147-0x00000000104F0000-0x0000000010560000-memory.dmpFilesize
448KB