Analysis
-
max time kernel
149s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 12:18
Static task
static1
Behavioral task
behavioral1
Sample
933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe
Resource
win7-20220812-en
General
-
Target
933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe
-
Size
294KB
-
MD5
1c410f1649d4eaed7f8fd0108267b4d9
-
SHA1
7fe9d89ac8fb16ed7f79d1fe06bd335d614dfb08
-
SHA256
933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3
-
SHA512
d46d6bf7c87df6d5643d57e72286f29a557890ea91bfd279142127b38d36ef22e63c8d73b4e760a7b8b45b81d1d9cfa0a2eb44be719df3c3c19744f4c8850b19
-
SSDEEP
6144:e60x6xG2DUxWGaEgxyDpUKrP1dIPgBw9zX1wYNfSEBtWWL:eP6xrDUMNxy9UokL9zNaEBtxL
Malware Config
Extracted
cybergate
2.7 Beta 02
victime
farfouch-hacker.no-ip.biz:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd1234
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
Tempdecrypted.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Tempdecrypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe" Tempdecrypted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Tempdecrypted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe" Tempdecrypted.exe -
Executes dropped EXE 3 IoCs
Processes:
Tempdecrypted.exeTempdecrypted.exeserver.exepid process 960 Tempdecrypted.exe 1424 Tempdecrypted.exe 1168 server.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
Tempdecrypted.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} Tempdecrypted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "c:\\dir\\install\\install\\server.exe Restart" Tempdecrypted.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Tempdecrypted.exe upx \Users\Admin\AppData\Local\Tempdecrypted.exe upx \Users\Admin\AppData\Local\Tempdecrypted.exe upx behavioral1/memory/960-63-0x0000000000400000-0x0000000000458000-memory.dmp upx C:\Users\Admin\AppData\Local\Tempdecrypted.exe upx behavioral1/memory/960-66-0x0000000024010000-0x0000000024072000-memory.dmp upx C:\Users\Admin\AppData\Local\Tempdecrypted.exe upx behavioral1/memory/1424-73-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/960-74-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/960-80-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1424-79-0x0000000024080000-0x00000000240E2000-memory.dmp upx \dir\install\install\server.exe upx C:\dir\install\install\server.exe upx \dir\install\install\server.exe upx C:\dir\install\install\server.exe upx behavioral1/memory/1424-89-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1168-91-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1168-92-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1424-94-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exeTempdecrypted.exepid process 1048 933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe 1048 933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe 1424 Tempdecrypted.exe 1424 Tempdecrypted.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Tempdecrypted.exepid process 960 Tempdecrypted.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Tempdecrypted.exepid process 1424 Tempdecrypted.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Tempdecrypted.exedescription pid process Token: SeDebugPrivilege 1424 Tempdecrypted.exe Token: SeDebugPrivilege 1424 Tempdecrypted.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exepid process 1048 933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exeTempdecrypted.exedescription pid process target process PID 1048 wrote to memory of 960 1048 933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe Tempdecrypted.exe PID 1048 wrote to memory of 960 1048 933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe Tempdecrypted.exe PID 1048 wrote to memory of 960 1048 933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe Tempdecrypted.exe PID 1048 wrote to memory of 960 1048 933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe Tempdecrypted.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe PID 960 wrote to memory of 1760 960 Tempdecrypted.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe"C:\Users\Admin\AppData\Local\Temp\933f84a4c952165dcf5c78413bb764491f527c8909ddf7602083732e166bd3c3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Tempdecrypted.exe"C:\Users\Admin\AppData\Local\Tempdecrypted.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Users\Admin\AppData\Local\Tempdecrypted.exe"C:\Users\Admin\AppData\Local\Tempdecrypted.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\dir\install\install\server.exe"C:\dir\install\install\server.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
230KB
MD5e36c7e764cc9f279e542522c0d75b4e5
SHA11db09a8c0ad3975264b88c660d6f82578201c590
SHA2568882bbfe54f833a6c0f225f45ec37da002e2c2dbfbc83c784700672087729e8f
SHA512c4ec5f7685631875e44b921ad7a2bc6ff827736f17728c82037c78e973a9d1b3f26c1b059a4f0b2c2d2810d798b678a97f21598fb549d2f3bed004effbf3575a
-
C:\Users\Admin\AppData\Local\Tempdecrypted.exeFilesize
277KB
MD5692ef0b811f0d3870a980485e56d1f64
SHA1912e771a698e902a7ff87f94b84adc1ae5feed68
SHA25649f30b03dbc2671ecfcb11ed39db5b002dece907b15b9529e68b8aaba9f1db4c
SHA512032c807f4c42903f615d5dd861212951746f6a66656d2d5f8498f8bebda580d85485824bd0c3ae87a532bf8b7123131ce689bd0d08f72479fc77619fe901a697
-
C:\Users\Admin\AppData\Local\Tempdecrypted.exeFilesize
277KB
MD5692ef0b811f0d3870a980485e56d1f64
SHA1912e771a698e902a7ff87f94b84adc1ae5feed68
SHA25649f30b03dbc2671ecfcb11ed39db5b002dece907b15b9529e68b8aaba9f1db4c
SHA512032c807f4c42903f615d5dd861212951746f6a66656d2d5f8498f8bebda580d85485824bd0c3ae87a532bf8b7123131ce689bd0d08f72479fc77619fe901a697
-
C:\Users\Admin\AppData\Local\Tempdecrypted.exeFilesize
277KB
MD5692ef0b811f0d3870a980485e56d1f64
SHA1912e771a698e902a7ff87f94b84adc1ae5feed68
SHA25649f30b03dbc2671ecfcb11ed39db5b002dece907b15b9529e68b8aaba9f1db4c
SHA512032c807f4c42903f615d5dd861212951746f6a66656d2d5f8498f8bebda580d85485824bd0c3ae87a532bf8b7123131ce689bd0d08f72479fc77619fe901a697
-
C:\dir\install\install\server.exeFilesize
277KB
MD5692ef0b811f0d3870a980485e56d1f64
SHA1912e771a698e902a7ff87f94b84adc1ae5feed68
SHA25649f30b03dbc2671ecfcb11ed39db5b002dece907b15b9529e68b8aaba9f1db4c
SHA512032c807f4c42903f615d5dd861212951746f6a66656d2d5f8498f8bebda580d85485824bd0c3ae87a532bf8b7123131ce689bd0d08f72479fc77619fe901a697
-
C:\dir\install\install\server.exeFilesize
277KB
MD5692ef0b811f0d3870a980485e56d1f64
SHA1912e771a698e902a7ff87f94b84adc1ae5feed68
SHA25649f30b03dbc2671ecfcb11ed39db5b002dece907b15b9529e68b8aaba9f1db4c
SHA512032c807f4c42903f615d5dd861212951746f6a66656d2d5f8498f8bebda580d85485824bd0c3ae87a532bf8b7123131ce689bd0d08f72479fc77619fe901a697
-
\Users\Admin\AppData\Local\Tempdecrypted.exeFilesize
277KB
MD5692ef0b811f0d3870a980485e56d1f64
SHA1912e771a698e902a7ff87f94b84adc1ae5feed68
SHA25649f30b03dbc2671ecfcb11ed39db5b002dece907b15b9529e68b8aaba9f1db4c
SHA512032c807f4c42903f615d5dd861212951746f6a66656d2d5f8498f8bebda580d85485824bd0c3ae87a532bf8b7123131ce689bd0d08f72479fc77619fe901a697
-
\Users\Admin\AppData\Local\Tempdecrypted.exeFilesize
277KB
MD5692ef0b811f0d3870a980485e56d1f64
SHA1912e771a698e902a7ff87f94b84adc1ae5feed68
SHA25649f30b03dbc2671ecfcb11ed39db5b002dece907b15b9529e68b8aaba9f1db4c
SHA512032c807f4c42903f615d5dd861212951746f6a66656d2d5f8498f8bebda580d85485824bd0c3ae87a532bf8b7123131ce689bd0d08f72479fc77619fe901a697
-
\dir\install\install\server.exeFilesize
277KB
MD5692ef0b811f0d3870a980485e56d1f64
SHA1912e771a698e902a7ff87f94b84adc1ae5feed68
SHA25649f30b03dbc2671ecfcb11ed39db5b002dece907b15b9529e68b8aaba9f1db4c
SHA512032c807f4c42903f615d5dd861212951746f6a66656d2d5f8498f8bebda580d85485824bd0c3ae87a532bf8b7123131ce689bd0d08f72479fc77619fe901a697
-
\dir\install\install\server.exeFilesize
277KB
MD5692ef0b811f0d3870a980485e56d1f64
SHA1912e771a698e902a7ff87f94b84adc1ae5feed68
SHA25649f30b03dbc2671ecfcb11ed39db5b002dece907b15b9529e68b8aaba9f1db4c
SHA512032c807f4c42903f615d5dd861212951746f6a66656d2d5f8498f8bebda580d85485824bd0c3ae87a532bf8b7123131ce689bd0d08f72479fc77619fe901a697
-
memory/960-63-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/960-66-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/960-59-0x0000000000000000-mapping.dmp
-
memory/960-74-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/960-80-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1048-56-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1048-61-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1168-85-0x0000000000000000-mapping.dmp
-
memory/1168-92-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1168-91-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1424-70-0x0000000000000000-mapping.dmp
-
memory/1424-79-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1424-88-0x0000000004AB0000-0x0000000004B08000-memory.dmpFilesize
352KB
-
memory/1424-89-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1424-90-0x0000000004AB0000-0x0000000004B08000-memory.dmpFilesize
352KB
-
memory/1424-73-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1424-77-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1424-93-0x0000000004AB0000-0x0000000004B08000-memory.dmpFilesize
352KB
-
memory/1424-94-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB