Analysis
-
max time kernel
193s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 10:19
Static task
static1
Behavioral task
behavioral1
Sample
e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe
Resource
win7-20221111-en
General
-
Target
e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe
-
Size
347KB
-
MD5
211195ac21eb346fa2daa526a7f6d292
-
SHA1
1f448ad122f9d3ed3ae89eb0a7851c02bc6be004
-
SHA256
e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b
-
SHA512
c4dc5c2c3a41ee0821866924b3ce21191a63ab6163bcbed5dc60fb57acac3f38ac915d2e1617b76cb0c4b3b8209a37bb5a8c5dcbef1601a963489c6b37859bff
-
SSDEEP
6144:ZFtTlXtdNCMHIwXFWXOd7YRqG2VSUhZBafR/8+scysK5G6sAebxZ1nW9YrTBsiBH:ZxX7NCA9XFWXP4G0SUhZBSRkmMvsfxZT
Malware Config
Extracted
cybergate
v1.07.5
123
onski123.no-ip.biz:9876
3IN7F8CKT1P2EL
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./public_html/logs/
-
ftp_interval
20
-
ftp_password
6a8w73bdOO
-
ftp_port
21
-
ftp_server
merch4gold.com
-
ftp_username
merch4go
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
false
-
keylogger_enable_ftp
true
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123456
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
lssam.exespolsv.exepid process 208 lssam.exe 3812 spolsv.exe -
Processes:
resource yara_rule behavioral2/memory/1832-155-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/4736-161-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/4736-164-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/2840-167-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/2840-169-0x0000000010410000-0x0000000010475000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exelssam.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation lssam.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
lssam.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\lssam.exe" lssam.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exespolsv.exedescription pid process target process PID 808 set thread context of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 3812 set thread context of 1832 3812 spolsv.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exelssam.exespolsv.exepid process 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe 208 lssam.exe 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe 3812 spolsv.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AppLaunch.exepid process 2840 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exelssam.exespolsv.exeAppLaunch.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe Token: SeDebugPrivilege 208 lssam.exe Token: SeDebugPrivilege 3812 spolsv.exe Token: SeBackupPrivilege 2840 AppLaunch.exe Token: SeRestorePrivilege 2840 AppLaunch.exe Token: SeBackupPrivilege 4736 AppLaunch.exe Token: SeRestorePrivilege 4736 AppLaunch.exe Token: SeDebugPrivilege 2840 AppLaunch.exe Token: SeDebugPrivilege 2840 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exeAppLaunch.exelssam.exespolsv.exedescription pid process target process PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 528 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe AppLaunch.exe PID 808 wrote to memory of 208 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe lssam.exe PID 808 wrote to memory of 208 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe lssam.exe PID 808 wrote to memory of 208 808 e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe lssam.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 528 wrote to memory of 4736 528 AppLaunch.exe AppLaunch.exe PID 208 wrote to memory of 3812 208 lssam.exe spolsv.exe PID 208 wrote to memory of 3812 208 lssam.exe spolsv.exe PID 208 wrote to memory of 3812 208 lssam.exe spolsv.exe PID 3812 wrote to memory of 1832 3812 spolsv.exe AppLaunch.exe PID 3812 wrote to memory of 1832 3812 spolsv.exe AppLaunch.exe PID 3812 wrote to memory of 1832 3812 spolsv.exe AppLaunch.exe PID 3812 wrote to memory of 1832 3812 spolsv.exe AppLaunch.exe PID 3812 wrote to memory of 1832 3812 spolsv.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe"C:\Users\Admin\AppData\Local\Temp\e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\System\lssam.exe"C:\Users\Admin\AppData\Local\Temp\System\lssam.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe"C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"5⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
224KB
MD5ccffbad317ffe99e76f538182fd41ccf
SHA1197cfd4b8fa468fbf105958196bd6df955759dc3
SHA2562ef2d0856193a0006b982d756c0f656ac60ea9abfb91c6ab04bc35336af82796
SHA5127f84e94420f49ef1383a885954f1c8829d5ce07659288eacee64f2a5f525b790b47cbb8031236907ae3a5eb9266cb25976666426d0741922337efecef7be7c1b
-
C:\Users\Admin\AppData\Local\Temp\System\lssam.exeFilesize
25KB
MD5b347591498c2c74cc3c23597cb1f34cc
SHA127054194904202938e3e7cdb10cf2c291767fdef
SHA25624ada6c187f2c3188bd3e437443822f4f87fd997d9cc8d6d4abf38ba28e8528b
SHA512e365f543b667ccc9b0fe5d3e5827e4df0f0f5a72676f3e7fc498ebe2f84d67d14db54d6742fdabe9c08004c6dce76d7befeac6b3f39ba1163663ae870ea973b6
-
C:\Users\Admin\AppData\Local\Temp\System\lssam.exeFilesize
25KB
MD5b347591498c2c74cc3c23597cb1f34cc
SHA127054194904202938e3e7cdb10cf2c291767fdef
SHA25624ada6c187f2c3188bd3e437443822f4f87fd997d9cc8d6d4abf38ba28e8528b
SHA512e365f543b667ccc9b0fe5d3e5827e4df0f0f5a72676f3e7fc498ebe2f84d67d14db54d6742fdabe9c08004c6dce76d7befeac6b3f39ba1163663ae870ea973b6
-
C:\Users\Admin\AppData\Local\Temp\System\spolsv.exeFilesize
347KB
MD5211195ac21eb346fa2daa526a7f6d292
SHA11f448ad122f9d3ed3ae89eb0a7851c02bc6be004
SHA256e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b
SHA512c4dc5c2c3a41ee0821866924b3ce21191a63ab6163bcbed5dc60fb57acac3f38ac915d2e1617b76cb0c4b3b8209a37bb5a8c5dcbef1601a963489c6b37859bff
-
C:\Users\Admin\AppData\Local\Temp\System\spolsv.exeFilesize
347KB
MD5211195ac21eb346fa2daa526a7f6d292
SHA11f448ad122f9d3ed3ae89eb0a7851c02bc6be004
SHA256e22a92a192751ca568942939c56829a1f00067427a809b7b7f77ca88b68f344b
SHA512c4dc5c2c3a41ee0821866924b3ce21191a63ab6163bcbed5dc60fb57acac3f38ac915d2e1617b76cb0c4b3b8209a37bb5a8c5dcbef1601a963489c6b37859bff
-
memory/208-145-0x0000000075240000-0x00000000757F1000-memory.dmpFilesize
5.7MB
-
memory/208-137-0x0000000000000000-mapping.dmp
-
memory/208-166-0x0000000075240000-0x00000000757F1000-memory.dmpFilesize
5.7MB
-
memory/528-136-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/528-133-0x0000000000000000-mapping.dmp
-
memory/528-135-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/528-134-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/808-132-0x0000000075240000-0x00000000757F1000-memory.dmpFilesize
5.7MB
-
memory/808-151-0x0000000075240000-0x00000000757F1000-memory.dmpFilesize
5.7MB
-
memory/1832-155-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/1832-147-0x0000000000000000-mapping.dmp
-
memory/2840-154-0x0000000000000000-mapping.dmp
-
memory/2840-167-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/2840-169-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/3812-146-0x0000000075240000-0x00000000757F1000-memory.dmpFilesize
5.7MB
-
memory/3812-143-0x0000000000000000-mapping.dmp
-
memory/3812-168-0x0000000075240000-0x00000000757F1000-memory.dmpFilesize
5.7MB
-
memory/3840-165-0x0000000000000000-mapping.dmp
-
memory/4736-161-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/4736-164-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/4736-141-0x0000000000000000-mapping.dmp