Analysis
-
max time kernel
26s -
max time network
30s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 00:01
Behavioral task
behavioral1
Sample
44e6a17304e6f70010f378b1ddb272c3.exe
Resource
win7-20231215-en
General
-
Target
44e6a17304e6f70010f378b1ddb272c3.exe
-
Size
858KB
-
MD5
44e6a17304e6f70010f378b1ddb272c3
-
SHA1
33b6b8a3bbcbe6f525c09a9c9b8fe677337eb021
-
SHA256
170b0b2f1444fc216b0d5e4905a0441053c41927eb85d91dc03ee5c8c1735279
-
SHA512
0d22af93710d7eabfb74c4c918178e2d14f68b4c0e3b96003640ec95e4c75e29ace14f38c08b24c11b4acf27c2accddf2f1b4efb9fffe26df75e4007edc8b3a1
-
SSDEEP
24576:SJsGL0ltYYo+hMrelc7TSDbGWMhuXImU2nK7:SJss8tRo2keSLmBI
Malware Config
Extracted
cybergate
v1.02.1
Lammer
127.0.0.1:57
Pluguin
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Microsoft
-
install_file
Pluguin.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
-
message_box_title
LAMMER
-
password
123456789
-
regkey_hkcu
Avirnt
-
regkey_hklm
Avgnt
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 44e6a17304e6f70010f378b1ddb272c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Microsoft\\Pluguin.exe" 44e6a17304e6f70010f378b1ddb272c3.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 44e6a17304e6f70010f378b1ddb272c3.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Microsoft\\Pluguin.exe" 44e6a17304e6f70010f378b1ddb272c3.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{J117WMVM-32D1-5FCT-JK8F-E48807I25UR5} 44e6a17304e6f70010f378b1ddb272c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{J117WMVM-32D1-5FCT-JK8F-E48807I25UR5}\StubPath = "C:\\Windows\\Microsoft\\Pluguin.exe Restart" 44e6a17304e6f70010f378b1ddb272c3.exe -
Processes:
resource yara_rule behavioral2/memory/3932-4-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral2/memory/3932-64-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral2/memory/540-69-0x0000000024070000-0x00000000240D0000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\Microsoft\\Pluguin.exe" 44e6a17304e6f70010f378b1ddb272c3.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\Microsoft\\Pluguin.exe" 44e6a17304e6f70010f378b1ddb272c3.exe -
Drops file in Windows directory 2 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription ioc process File created C:\Windows\Microsoft\Pluguin.exe 44e6a17304e6f70010f378b1ddb272c3.exe File opened for modification C:\Windows\Microsoft\Pluguin.exe 44e6a17304e6f70010f378b1ddb272c3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exepid process 3932 44e6a17304e6f70010f378b1ddb272c3.exe 3932 44e6a17304e6f70010f378b1ddb272c3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exepid process 3932 44e6a17304e6f70010f378b1ddb272c3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
44e6a17304e6f70010f378b1ddb272c3.exedescription pid process target process PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE PID 3932 wrote to memory of 3332 3932 44e6a17304e6f70010f378b1ddb272c3.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\44e6a17304e6f70010f378b1ddb272c3.exe"C:\Users\Admin\AppData\Local\Temp\44e6a17304e6f70010f378b1ddb272c3.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\44e6a17304e6f70010f378b1ddb272c3.exe"C:\Users\Admin\AppData\Local\Temp\44e6a17304e6f70010f378b1ddb272c3.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/540-8-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/540-9-0x0000000001070000-0x0000000001071000-memory.dmpFilesize
4KB
-
memory/540-67-0x0000000003B60000-0x0000000003B61000-memory.dmpFilesize
4KB
-
memory/540-69-0x0000000024070000-0x00000000240D0000-memory.dmpFilesize
384KB
-
memory/3932-0-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/3932-4-0x0000000024010000-0x0000000024070000-memory.dmpFilesize
384KB
-
memory/3932-64-0x0000000024070000-0x00000000240D0000-memory.dmpFilesize
384KB