Analysis
-
max time kernel
158s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 14:14
Behavioral task
behavioral1
Sample
b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe
Resource
win7-20220901-en
General
-
Target
b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe
-
Size
860KB
-
MD5
4eddd070fa5aa3359fa83a03c109946c
-
SHA1
14196a95592659aa960db4afa20f7f80e016839f
-
SHA256
b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a
-
SHA512
9adceb76951a016260fa24b9c12013311a2488fe1be918cf23c806d16bbfbc2644941fed0b06fca11ccd10146ea5d804ddb1a4b0fda9f4a70bbc8f90b9b73b69
-
SSDEEP
12288:M39wslcTBd47GLRMTbmVt8BURgxr/V+phmdE808YKXF:dsl6d474mfmVtAUsUphmdErp
Malware Config
Extracted
cybergate
v1.07.5
victime
bshades95.no-ip.org:82
3K65S1BAQYI442
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Settings
-
install_file
opera.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Le fichier n'est pas un éxécutable valide. Veuillez vérifier votre compabilité plateforme x32 ou x64bits.
-
message_box_title
explorer.exe
-
password
hacker
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Settings\\opera.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Settings\\opera.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe -
Executes dropped EXE 5 IoCs
Processes:
svchost.execsrss.exesvchost.exeopera.exeopera.exepid process 700 svchost.exe 1484 csrss.exe 1180 svchost.exe 1504 opera.exe 1544 opera.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{J3E0R0P6-1KT2-3BDO-KPI6-I3225281842Q} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{J3E0R0P6-1KT2-3BDO-KPI6-I3225281842Q}\StubPath = "C:\\Windows\\system32\\Settings\\opera.exe Restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{J3E0R0P6-1KT2-3BDO-KPI6-I3225281842Q} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{J3E0R0P6-1KT2-3BDO-KPI6-I3225281842Q}\StubPath = "C:\\Windows\\system32\\Settings\\opera.exe" explorer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\csrss.exe upx behavioral1/memory/1484-64-0x0000000000400000-0x000000000055D000-memory.dmp upx behavioral1/memory/700-67-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral1/memory/700-76-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/568-81-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/568-84-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/700-86-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral1/memory/700-94-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/1180-99-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/1180-110-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/1180-111-0x0000000010560000-0x00000000105C5000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
svchost.exesvchost.exepid process 700 svchost.exe 700 svchost.exe 700 svchost.exe 1180 svchost.exe 1180 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Settings\\opera.exe" svchost.exe -
Drops file in System32 directory 4 IoCs
Processes:
svchost.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\Settings\opera.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Settings\opera.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Settings\opera.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Settings\ svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svchost.exepid process 1180 svchost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
explorer.exesvchost.exedescription pid process Token: SeBackupPrivilege 568 explorer.exe Token: SeRestorePrivilege 568 explorer.exe Token: SeBackupPrivilege 1180 svchost.exe Token: SeRestorePrivilege 1180 svchost.exe Token: SeDebugPrivilege 1180 svchost.exe Token: SeDebugPrivilege 1180 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svchost.exepid process 700 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
csrss.exepid process 1484 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exesvchost.exedescription pid process target process PID 1652 wrote to memory of 700 1652 b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe svchost.exe PID 1652 wrote to memory of 700 1652 b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe svchost.exe PID 1652 wrote to memory of 700 1652 b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe svchost.exe PID 1652 wrote to memory of 700 1652 b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe svchost.exe PID 1652 wrote to memory of 1484 1652 b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe csrss.exe PID 1652 wrote to memory of 1484 1652 b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe csrss.exe PID 1652 wrote to memory of 1484 1652 b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe csrss.exe PID 1652 wrote to memory of 1484 1652 b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe csrss.exe PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE PID 700 wrote to memory of 1212 700 svchost.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe"C:\Users\Admin\AppData\Local\Temp\b00424edfc48711031bad31abfe49fda518bae28377d2fb2f473105770dc988a.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Settings\opera.exe"C:\Windows\system32\Settings\opera.exe"5⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Windows\SysWOW64\Settings\opera.exe"C:\Windows\system32\Settings\opera.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\csrss.exe"C:\Users\Admin\AppData\Local\Temp\csrss.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
224KB
MD57214fa5f49eeb6876955565146e6ad96
SHA1ab83b1b9882cf1578f7766777d1fbfb3d3131590
SHA256d8a08fea0dab5a23c342496aea7f59e739ba69899349e9fae1773704420e2b26
SHA5127abea091d8544558eee750cc37843631803a8148f4da5a4f0dcd06432042266981e446b1bfa6ead43f2a1e484d63bce1ef06973331aa2c8ca1aec249f4935a6f
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
379KB
MD59a2347903d6edb84c10f288bc0578c1c
SHA1ae96a47e781ed600704b0b040f6b5c8a92ac5e51
SHA2565dca5dad7a63810dacee7f38c098a7b2d68617bf8175f05147e44d19dfa57a04
SHA512e80a158455179bdad7cd388beee9ccfa6e89073671e7386f14e00bf0c4b96e998db50f1274fe5371e518f2ffe8279d0038996da384d1555bd36926b17797a29d
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
C:\Windows\SysWOW64\Settings\opera.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
C:\Windows\SysWOW64\Settings\opera.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
C:\Windows\SysWOW64\Settings\opera.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
\Windows\SysWOW64\Settings\opera.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
\Windows\SysWOW64\Settings\opera.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
\Windows\SysWOW64\Settings\opera.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
\Windows\SysWOW64\Settings\opera.exeFilesize
296KB
MD51b992f0ff95138b3eaf7a0fdc8dc4ea3
SHA1be861be10bd11d5db5cfa02cf930cedbe50ad848
SHA256c427895505ab0ff191447548c21133aa3d0c01009627683d4b9ab19c8a46fec0
SHA51236255f061e28b52eb5b4d5defe38fe8f8a1ca21d2f344a936fdac416c0b66fc013223d462f609eea3b9f5f7516e5efab554223bd80aaeff1ff6ef10fc34ab33c
-
memory/568-75-0x0000000074511000-0x0000000074513000-memory.dmpFilesize
8KB
-
memory/568-81-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/568-84-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/568-73-0x0000000000000000-mapping.dmp
-
memory/700-76-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/700-94-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/700-56-0x0000000000000000-mapping.dmp
-
memory/700-86-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/700-58-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/700-67-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/1180-99-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/1180-91-0x0000000000000000-mapping.dmp
-
memory/1180-110-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/1180-111-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/1212-70-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/1484-64-0x0000000000400000-0x000000000055D000-memory.dmpFilesize
1.4MB
-
memory/1484-59-0x0000000000000000-mapping.dmp
-
memory/1504-102-0x0000000000000000-mapping.dmp
-
memory/1544-107-0x0000000000000000-mapping.dmp
-
memory/1652-54-0x000007FEF4680000-0x000007FEF50A3000-memory.dmpFilesize
10.1MB
-
memory/1652-61-0x0000000000B36000-0x0000000000B55000-memory.dmpFilesize
124KB
-
memory/1652-55-0x000007FEF33A0000-0x000007FEF4436000-memory.dmpFilesize
16.6MB