Analysis
-
max time kernel
4s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-12-2023 13:25
Static task
static1
Behavioral task
behavioral1
Sample
e1244933acb430852b20d1432e928d75.exe
Resource
win7-20231215-en
General
-
Target
e1244933acb430852b20d1432e928d75.exe
-
Size
1.4MB
-
MD5
e1244933acb430852b20d1432e928d75
-
SHA1
c585ecff31d04694d97983d97908909365cae10d
-
SHA256
79f82ee9da61b74176144e3f9652bc495b5e59d8d51e3673de6ae2b090642d11
-
SHA512
00d7ed2605ab14a33c6edca3dc81f08fdf08b57cbc7f4f3ba7371a3a74482c6be9dd2b9e0d2dd5dc2e7c1d5544f523ddab3b22b80831838cf5d5311c83f7d53c
-
SSDEEP
6144:vy8zsjDKEzZwe2n/M+WJ/04KL3MRAMFSp1aRGJ5sdKptxhSPdW9KZw:vypjDv52004Xq4I9K
Malware Config
Extracted
cybergate
2.6
ViCTiMa
patriphone.no-ip.info:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
svchost.exe
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
e1244933acb430852b20d1432e928d75.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\\server.exe" e1244933acb430852b20d1432e928d75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e1244933acb430852b20d1432e928d75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\\server.exe" e1244933acb430852b20d1432e928d75.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e1244933acb430852b20d1432e928d75.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
e1244933acb430852b20d1432e928d75.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{51U04V2F-85C2-6TRY-065W-N1KY43Y7T0Y3} e1244933acb430852b20d1432e928d75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51U04V2F-85C2-6TRY-065W-N1KY43Y7T0Y3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\\server.exe Restart" e1244933acb430852b20d1432e928d75.exe -
Processes:
resource yara_rule behavioral1/memory/1912-5-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1912-7-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1912-6-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1912-4-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1912-2-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1304-543-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1912-627-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/3004-840-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1912-842-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/2016-1144-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1304-2643-0x00000000318D0000-0x00000000318DD000-memory.dmp upx behavioral1/memory/2016-2734-0x00000000318F0000-0x00000000318FD000-memory.dmp upx behavioral1/memory/1304-2733-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/2016-2743-0x00000000318F0000-0x00000000318FD000-memory.dmp upx behavioral1/memory/2016-2742-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/3004-2879-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1304-3445-0x00000000318D0000-0x00000000318DD000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e1244933acb430852b20d1432e928d75.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\\server.exe" e1244933acb430852b20d1432e928d75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\\server.exe" e1244933acb430852b20d1432e928d75.exe -
Drops file in System32 directory 1 IoCs
Processes:
e1244933acb430852b20d1432e928d75.exedescription ioc process File created C:\Windows\SysWOW64\svchost.exe\server.exe e1244933acb430852b20d1432e928d75.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e1244933acb430852b20d1432e928d75.exedescription pid process target process PID 2024 set thread context of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e1244933acb430852b20d1432e928d75.exepid process 1912 e1244933acb430852b20d1432e928d75.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
e1244933acb430852b20d1432e928d75.exepid process 1912 e1244933acb430852b20d1432e928d75.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e1244933acb430852b20d1432e928d75.exepid process 2024 e1244933acb430852b20d1432e928d75.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e1244933acb430852b20d1432e928d75.exee1244933acb430852b20d1432e928d75.exedescription pid process target process PID 2024 wrote to memory of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe PID 2024 wrote to memory of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe PID 2024 wrote to memory of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe PID 2024 wrote to memory of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe PID 2024 wrote to memory of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe PID 2024 wrote to memory of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe PID 2024 wrote to memory of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe PID 2024 wrote to memory of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe PID 2024 wrote to memory of 1912 2024 e1244933acb430852b20d1432e928d75.exe e1244933acb430852b20d1432e928d75.exe PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE PID 1912 wrote to memory of 1144 1912 e1244933acb430852b20d1432e928d75.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e1244933acb430852b20d1432e928d75.exe"C:\Users\Admin\AppData\Local\Temp\e1244933acb430852b20d1432e928d75.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1244933acb430852b20d1432e928d75.exe"C:\Users\Admin\AppData\Local\Temp\e1244933acb430852b20d1432e928d75.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\e1244933acb430852b20d1432e928d75.exe"C:\Users\Admin\AppData\Local\Temp\e1244933acb430852b20d1432e928d75.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\svchost.exe\server.exe"C:\Users\Admin\AppData\Roaming\svchost.exe\server.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\svchost.exe\server.exe"C:\Users\Admin\AppData\Roaming\svchost.exe\server.exe"6⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1144-11-0x0000000002DF0000-0x0000000002DF1000-memory.dmpFilesize
4KB
-
memory/1304-259-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1304-2643-0x00000000318D0000-0x00000000318DD000-memory.dmpFilesize
52KB
-
memory/1304-2733-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1304-3445-0x00000000318D0000-0x00000000318DD000-memory.dmpFilesize
52KB
-
memory/1304-543-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1304-257-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/1912-4-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1912-2-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1912-627-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1912-5-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1912-842-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1912-6-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1912-7-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/2016-2734-0x00000000318F0000-0x00000000318FD000-memory.dmpFilesize
52KB
-
memory/2016-2702-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2016-1144-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/2016-2703-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2016-2743-0x00000000318F0000-0x00000000318FD000-memory.dmpFilesize
52KB
-
memory/2016-2742-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/3004-2879-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/3004-840-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB