Resubmissions

28-04-2024 18:31

240428-w6cwyaec5v 10

21-04-2024 08:57

240421-kwwqhsfh8z 10

21-04-2024 05:45

240421-gfvazacf82 10

18-04-2024 19:05

240418-xry2ascb73 10

18-04-2024 16:34

240418-t3alashf75 10

04-03-2024 18:33

240304-w7b12ahg61 10

02-03-2024 17:01

240302-vjn51sff57 10

02-03-2024 10:05

240302-l4xhfscc7v 10

Analysis

  • max time kernel
    137s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2023 06:40

General

  • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe

  • Size

    58KB

  • MD5

    e777bc84ca195b357d3e762ed397a510

  • SHA1

    159268993b0f8b0498ea994ff0b370cca3ed9fd9

  • SHA256

    aac437030e9124f5a39f58ede1eedf0a786091efbce4fe697b468d7c2d907ac6

  • SHA512

    8ce4ecb25b23db00cc1a492b783f7c84d3564c9a3b81fc236a16f35c4e39c5bb80c4a3fe88d5d37d67c7fc0cf691c276a42f2bbd48009271075e24d9637a807d

  • SSDEEP

    768:iamxy0a+qFOdq34MiCahA3A8jCNTVU/1SQLD0JbdW9CxHu+T0C/zI4Rn1YcNLCf:tUy1dZ3DaTK1S6D0JbdW9Cx3T065n3LK

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.SpyGate.exe
    "C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.SpyGate.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1124
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1380
      2⤵
      • Program crash
      PID:3224
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1124 -ip 1124
    1⤵
      PID:4156

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1124-133-0x0000000000070000-0x0000000000084000-memory.dmp
      Filesize

      80KB

    • memory/1124-134-0x0000000004A10000-0x0000000004AAC000-memory.dmp
      Filesize

      624KB

    • memory/1124-135-0x0000000075360000-0x0000000075B10000-memory.dmp
      Filesize

      7.7MB

    • memory/1124-136-0x0000000005060000-0x0000000005604000-memory.dmp
      Filesize

      5.6MB

    • memory/1124-137-0x0000000004B50000-0x0000000004BE2000-memory.dmp
      Filesize

      584KB

    • memory/1124-138-0x0000000004CE0000-0x0000000004CF0000-memory.dmp
      Filesize

      64KB

    • memory/1124-140-0x0000000004DE0000-0x0000000004E36000-memory.dmp
      Filesize

      344KB

    • memory/1124-139-0x0000000004B20000-0x0000000004B2A000-memory.dmp
      Filesize

      40KB

    • memory/1124-144-0x0000000075360000-0x0000000075B10000-memory.dmp
      Filesize

      7.7MB