Analysis
-
max time kernel
188s -
max time network
200s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 16:24
Behavioral task
behavioral1
Sample
9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe
Resource
win7-20221111-en
General
-
Target
9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe
-
Size
428KB
-
MD5
4706ee52cbd9511c933c2fd42ecfd6b0
-
SHA1
6ee01365aeff8d50119912dd207156b480ef0cb2
-
SHA256
9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1
-
SHA512
fdf2e84edadc73a730807a776ac75d1397aa9f9d4570c878745a3a673c1acddd62f44853e4d9e94f8935ba515d832eacb73dbd2f4de28a6de2ba95148f580840
-
SSDEEP
12288:huMw+Bi8vvrHxVPKyv2m77sZB07FxObO32Y:hHwn8vrx52t07FQaj
Malware Config
Extracted
cybergate
v3.4.2.2
1
95.182.34.83:81
2XC28T623TIA46
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe" 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe" 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0NFV13T8-418H-CB88-8461-5037WB0268LP} 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0NFV13T8-418H-CB88-8461-5037WB0268LP}\StubPath = "C:\\Windows\\install\\server.exe Restart" 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0NFV13T8-418H-CB88-8461-5037WB0268LP} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0NFV13T8-418H-CB88-8461-5037WB0268LP}\StubPath = "C:\\Windows\\install\\server.exe" explorer.exe -
Processes:
resource yara_rule behavioral1/memory/1764-56-0x0000000010410000-0x0000000010480000-memory.dmp upx behavioral1/memory/1764-65-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral1/memory/1176-70-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral1/memory/1176-71-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral1/memory/1764-78-0x00000000104F0000-0x0000000010560000-memory.dmp upx behavioral1/memory/1532-83-0x00000000104F0000-0x0000000010560000-memory.dmp upx behavioral1/memory/1532-84-0x00000000104F0000-0x0000000010560000-memory.dmp upx behavioral1/memory/1176-85-0x0000000010480000-0x00000000104F0000-memory.dmp upx behavioral1/memory/1532-86-0x00000000104F0000-0x0000000010560000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\server.exe" 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\server.exe" 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe -
Drops file in Windows directory 5 IoCs
Processes:
9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exeexplorer.exedescription ioc process File created C:\Windows\install\server.exe 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe File opened for modification C:\Windows\install\server.exe 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe File opened for modification C:\Windows\install\ 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe File opened for modification C:\Windows\install\server.exe explorer.exe File opened for modification C:\Windows\install\ explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
explorer.exedescription pid process Token: SeDebugPrivilege 1532 explorer.exe Token: SeDebugPrivilege 1532 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exepid process 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exedescription pid process target process PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE PID 1764 wrote to memory of 1268 1764 9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe"C:\Users\Admin\AppData\Local\Temp\9f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies Installed Components in the registry
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
385KB
MD5eab19b6851390ecdf639e5d4eb7b9c30
SHA183195bc4ad1c76fd697a4e2ef7bf8f2df60c5a96
SHA2569a01133144890dcd7055b2a06a9bff6428fca5cead4f87905d5268f1711e6140
SHA5123f0f8c50813da391c2e157fbda6d1e53f9a08b972d681e1f3328fc37fd3bb72b7921849f05540eea711896c7cd4aca7b84d1474d66b01ec2a4dd7b1d4f451ad4
-
C:\Windows\install\server.exeFilesize
428KB
MD54706ee52cbd9511c933c2fd42ecfd6b0
SHA16ee01365aeff8d50119912dd207156b480ef0cb2
SHA2569f81e30a0a0c6da5d18394f64e21082b45642607b95d83def6222b053f74cef1
SHA512fdf2e84edadc73a730807a776ac75d1397aa9f9d4570c878745a3a673c1acddd62f44853e4d9e94f8935ba515d832eacb73dbd2f4de28a6de2ba95148f580840
-
memory/1176-64-0x00000000752A1000-0x00000000752A3000-memory.dmpFilesize
8KB
-
memory/1176-85-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/1176-62-0x0000000000000000-mapping.dmp
-
memory/1176-70-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/1176-71-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/1268-59-0x0000000010410000-0x0000000010480000-memory.dmpFilesize
448KB
-
memory/1532-83-0x00000000104F0000-0x0000000010560000-memory.dmpFilesize
448KB
-
memory/1532-75-0x0000000000000000-mapping.dmp
-
memory/1532-84-0x00000000104F0000-0x0000000010560000-memory.dmpFilesize
448KB
-
memory/1532-86-0x00000000104F0000-0x0000000010560000-memory.dmpFilesize
448KB
-
memory/1764-56-0x0000000010410000-0x0000000010480000-memory.dmpFilesize
448KB
-
memory/1764-78-0x00000000104F0000-0x0000000010560000-memory.dmpFilesize
448KB
-
memory/1764-65-0x0000000010480000-0x00000000104F0000-memory.dmpFilesize
448KB
-
memory/1764-54-0x00000000767F1000-0x00000000767F3000-memory.dmpFilesize
8KB