Analysis
-
max time kernel
3s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2023 10:56
Static task
static1
Behavioral task
behavioral1
Sample
690bbdc7e3ed1098a103246cdd052b70.exe
Resource
win7-20231215-en
General
-
Target
690bbdc7e3ed1098a103246cdd052b70.exe
-
Size
343KB
-
MD5
690bbdc7e3ed1098a103246cdd052b70
-
SHA1
15ab1fe8abe3a11463d3de05f23c84b861e56ed5
-
SHA256
3bbd1d2936731f9ee97490a23c8e46a90e369281d264ebbc1bc4abd2f87dd86a
-
SHA512
deb6a24a6cdfccc63e2f82c85f60a35f9a08c0a2dff78f925f2ca2495bf2b3d151f2f63de3594be87a6032ff309790ae6291937a63496e106c96f19cec3484c3
-
SSDEEP
6144:7JaYS32lyfsB0x9SU72F8vnidmrQYnfAo0AVOE2z6tTa+xKhnv:7JCGH6xAc2yPquQA8lzG+h
Malware Config
Extracted
cybergate
2.6
1877
fir3wall.zapto.org:84
127.0.0.1:84
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
rundll
-
install_file
rundll32.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd1234
-
regkey_hkcu
rundll32
-
regkey_hklm
rundll
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
690bbdc7e3ed1098a103246cdd052b70.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 690bbdc7e3ed1098a103246cdd052b70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundll\\rundll32.exe" 690bbdc7e3ed1098a103246cdd052b70.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 690bbdc7e3ed1098a103246cdd052b70.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\rundll\\rundll32.exe" 690bbdc7e3ed1098a103246cdd052b70.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
690bbdc7e3ed1098a103246cdd052b70.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2534A6Q0-ADLS-7XAJ-172N-7URR06AW832J} 690bbdc7e3ed1098a103246cdd052b70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2534A6Q0-ADLS-7XAJ-172N-7URR06AW832J}\StubPath = "C:\\Windows\\system32\\rundll\\rundll32.exe Restart" 690bbdc7e3ed1098a103246cdd052b70.exe -
Processes:
resource yara_rule behavioral2/memory/1364-3-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1364-4-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1364-2-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1364-0-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1364-68-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/4112-73-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/1364-8-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/1364-145-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2716-143-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/1648-172-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1648-175-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/4112-440-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/2716-1119-0x0000000024160000-0x00000000241C2000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
690bbdc7e3ed1098a103246cdd052b70.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rundll = "C:\\Windows\\system32\\rundll\\rundll32.exe" 690bbdc7e3ed1098a103246cdd052b70.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Windows\\system32\\rundll\\rundll32.exe" 690bbdc7e3ed1098a103246cdd052b70.exe -
Drops file in System32 directory 2 IoCs
Processes:
690bbdc7e3ed1098a103246cdd052b70.exedescription ioc process File created C:\Windows\SysWOW64\rundll\rundll32.exe 690bbdc7e3ed1098a103246cdd052b70.exe File opened for modification C:\Windows\SysWOW64\rundll\rundll32.exe 690bbdc7e3ed1098a103246cdd052b70.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
690bbdc7e3ed1098a103246cdd052b70.exedescription pid process target process PID 1744 set thread context of 1364 1744 690bbdc7e3ed1098a103246cdd052b70.exe 690bbdc7e3ed1098a103246cdd052b70.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4124 1648 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
690bbdc7e3ed1098a103246cdd052b70.exepid process 1364 690bbdc7e3ed1098a103246cdd052b70.exe 1364 690bbdc7e3ed1098a103246cdd052b70.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
690bbdc7e3ed1098a103246cdd052b70.exepid process 1364 690bbdc7e3ed1098a103246cdd052b70.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
690bbdc7e3ed1098a103246cdd052b70.exe690bbdc7e3ed1098a103246cdd052b70.exedescription pid process target process PID 1744 wrote to memory of 1364 1744 690bbdc7e3ed1098a103246cdd052b70.exe 690bbdc7e3ed1098a103246cdd052b70.exe PID 1744 wrote to memory of 1364 1744 690bbdc7e3ed1098a103246cdd052b70.exe 690bbdc7e3ed1098a103246cdd052b70.exe PID 1744 wrote to memory of 1364 1744 690bbdc7e3ed1098a103246cdd052b70.exe 690bbdc7e3ed1098a103246cdd052b70.exe PID 1744 wrote to memory of 1364 1744 690bbdc7e3ed1098a103246cdd052b70.exe 690bbdc7e3ed1098a103246cdd052b70.exe PID 1744 wrote to memory of 1364 1744 690bbdc7e3ed1098a103246cdd052b70.exe 690bbdc7e3ed1098a103246cdd052b70.exe PID 1744 wrote to memory of 1364 1744 690bbdc7e3ed1098a103246cdd052b70.exe 690bbdc7e3ed1098a103246cdd052b70.exe PID 1744 wrote to memory of 1364 1744 690bbdc7e3ed1098a103246cdd052b70.exe 690bbdc7e3ed1098a103246cdd052b70.exe PID 1744 wrote to memory of 1364 1744 690bbdc7e3ed1098a103246cdd052b70.exe 690bbdc7e3ed1098a103246cdd052b70.exe PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE PID 1364 wrote to memory of 3500 1364 690bbdc7e3ed1098a103246cdd052b70.exe Explorer.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\690bbdc7e3ed1098a103246cdd052b70.exe"C:\Users\Admin\AppData\Local\Temp\690bbdc7e3ed1098a103246cdd052b70.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\690bbdc7e3ed1098a103246cdd052b70.exe"C:\Users\Admin\AppData\Local\Temp\690bbdc7e3ed1098a103246cdd052b70.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\690bbdc7e3ed1098a103246cdd052b70.exe"C:\Users\Admin\AppData\Local\Temp\690bbdc7e3ed1098a103246cdd052b70.exe"3⤵
-
C:\Windows\SysWOW64\rundll\rundll32.exe"C:\Windows\system32\rundll\rundll32.exe"4⤵
-
C:\Windows\SysWOW64\rundll\rundll32.exe"C:\Windows\SysWOW64\rundll\rundll32.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 7086⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 16481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD5d895ebe1e71f799ff462aef2c3230e6b
SHA1efe3402e505baeb2cd75f16033a65688a443cddf
SHA256b0ef8735d77f96c7a339d7eb22079cc9d285c56bc64c68d755d29bbbe36ee7b3
SHA512ffe1abb299c09bfa08bb886f847196bd184661b40d46977a00649992e8293af74ae7bb103723d8256f87942637129079850604416c0a4496cdd8b2ab74cef4a5
-
C:\Users\Admin\AppData\Roaming\logs.datFilesize
15B
MD5e21bd9604efe8ee9b59dc7605b927a2a
SHA13240ecc5ee459214344a1baac5c2a74046491104
SHA25651a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
SHA51242052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
-
C:\Windows\SysWOW64\rundll\rundll32.exeFilesize
343KB
MD5690bbdc7e3ed1098a103246cdd052b70
SHA115ab1fe8abe3a11463d3de05f23c84b861e56ed5
SHA2563bbd1d2936731f9ee97490a23c8e46a90e369281d264ebbc1bc4abd2f87dd86a
SHA512deb6a24a6cdfccc63e2f82c85f60a35f9a08c0a2dff78f925f2ca2495bf2b3d151f2f63de3594be87a6032ff309790ae6291937a63496e106c96f19cec3484c3
-
memory/1364-2-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1364-4-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1364-68-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1364-3-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1364-8-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1364-145-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1364-0-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1648-175-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1648-172-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2716-143-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/2716-1119-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/4112-12-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/4112-73-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/4112-13-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/4112-440-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB