Analysis
-
max time kernel
205s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 17:32
Static task
static1
Behavioral task
behavioral1
Sample
cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe
Resource
win7-20221111-en
General
-
Target
cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe
-
Size
552KB
-
MD5
b1c5c7e1e68a9fa96181913679b4bdbc
-
SHA1
7b7ff433011cb9e00e3dbbacd3de90c5509e53a1
-
SHA256
cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c
-
SHA512
ca8116bbf18aff88fc21a789a9dfbf0c00cec955a272c9359c357f393f41a3d864969b14a0000f9eceebcdcb5fa1334b9d71420a00229c59b3284d25bb58820f
-
SSDEEP
12288:aSNwanCWMXw2tLteRwjkxuSNB6giWmjVv3XJx:aSGanCgSgwYiDFH
Malware Config
Extracted
cybergate
v1.07.5
mike
iamgreatl33t.no-ip.org:1723
EUB6MQ52B01S78
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
blade
-
install_file
csc.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\blade\\csc.exe" vbc.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\blade\\csc.exe" vbc.exe -
Executes dropped EXE 1 IoCs
pid Process 1068 csc.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6I11880P-I0T7-VD4L-OEX4-5WS33A6434J2} vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6I11880P-I0T7-VD4L-OEX4-5WS33A6434J2}\StubPath = "C:\\blade\\csc.exe Restart" vbc.exe -
resource yara_rule behavioral1/memory/888-56-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/888-58-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/888-59-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/888-63-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/888-65-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/888-66-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/888-68-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral1/memory/888-74-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/888-80-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1776-79-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1776-86-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1776-87-0x0000000010480000-0x00000000104E5000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1776 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\blade\\csc.exe" vbc.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\blade\\csc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1364 set thread context of 888 1364 cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe 28 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 1776 vbc.exe Token: SeRestorePrivilege 1776 vbc.exe Token: SeDebugPrivilege 1776 vbc.exe Token: SeDebugPrivilege 1776 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1364 wrote to memory of 888 1364 cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe 28 PID 1364 wrote to memory of 888 1364 cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe 28 PID 1364 wrote to memory of 888 1364 cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe 28 PID 1364 wrote to memory of 888 1364 cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe 28 PID 1364 wrote to memory of 888 1364 cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe 28 PID 1364 wrote to memory of 888 1364 cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe 28 PID 1364 wrote to memory of 888 1364 cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe 28 PID 1364 wrote to memory of 888 1364 cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe 28 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29 PID 888 wrote to memory of 268 888 vbc.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe"C:\Users\Admin\AppData\Local\Temp\cca1eff70c8875bee98cefcd9cd42592ad2c07aaf69503d9429458088bfdf10c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:268
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\blade\csc.exe"C:\blade\csc.exe"4⤵
- Executes dropped EXE
PID:1068
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5137e95613ebd406a01bda0b8ac115d95
SHA12dd73595f7ca917a8d4d0f983055e8efc893c683
SHA25660d3235643c895b206c5f342b3e3c308660c84b1ed0caf183d34513b5b1a5df2
SHA512a3af999a4adcdb93f4fd7383050a07cb952f7f60f0148ae7659d2c0368332c247a98e5ab1655936cc80361ca75f5b74ef43908c0d7222ec82852627f0dfdc240
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98