Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 00:47
Static task
static1
Behavioral task
behavioral1
Sample
0905d0737fafaf27658a9f3e5329af50.exe
Resource
win7-20231215-en
General
-
Target
0905d0737fafaf27658a9f3e5329af50.exe
-
Size
307KB
-
MD5
0905d0737fafaf27658a9f3e5329af50
-
SHA1
86f49086c125b3cd9789ad400ac99a37aa5aaf0e
-
SHA256
f0186abaeae3c0bc5d845aea4ffbce1f1562578be1322c3a10ca3c3cce0457d0
-
SHA512
35bb0fb3f59bdfc722c24a9c212ce55a77da40dee6b2882f0a4ff17d53d69cd4fc5b2f6faff7790647ee0d94ba1d964eee0bd688b05e179828ce1f6cd013e479
-
SSDEEP
6144:XQtn+uhG6T8Nbjah3dXjIH0pm8m9q2O+qCrgTTIkW8s5XUUJZ:XSfI6ObOhBkUvEq21BC8kW8eTZ
Malware Config
Extracted
cybergate
v1.07.5
victima
servinpetraca.zapto.org:2000
4M1R6CYS2PW85P
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
Direct
-
install_file
Direct.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
System Check Incomplete
-
message_box_title
Error
-
password
1992
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
0905d0737fafaf27658a9f3e5329af50.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 0905d0737fafaf27658a9f3e5329af50.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Direct\\Direct.exe" 0905d0737fafaf27658a9f3e5329af50.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 0905d0737fafaf27658a9f3e5329af50.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\Direct\\Direct.exe" 0905d0737fafaf27658a9f3e5329af50.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
0905d0737fafaf27658a9f3e5329af50.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{KL1KXRSD-H6M2-411U-1U81-82RB0P88Q0S0} 0905d0737fafaf27658a9f3e5329af50.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{KL1KXRSD-H6M2-411U-1U81-82RB0P88Q0S0}\StubPath = "C:\\Windows\\Direct\\Direct.exe Restart" 0905d0737fafaf27658a9f3e5329af50.exe -
Processes:
resource yara_rule behavioral1/memory/1588-4-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1588-5-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1588-8-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1588-10-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1588-12-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1588-11-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1588-310-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0905d0737fafaf27658a9f3e5329af50.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\Direct\\Direct.exe" 0905d0737fafaf27658a9f3e5329af50.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\Direct\\Direct.exe" 0905d0737fafaf27658a9f3e5329af50.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0905d0737fafaf27658a9f3e5329af50.exedescription pid process target process PID 2884 set thread context of 1588 2884 0905d0737fafaf27658a9f3e5329af50.exe 0905d0737fafaf27658a9f3e5329af50.exe -
Drops file in Windows directory 2 IoCs
Processes:
0905d0737fafaf27658a9f3e5329af50.exedescription ioc process File created C:\Windows\Direct\Direct.exe 0905d0737fafaf27658a9f3e5329af50.exe File opened for modification C:\Windows\Direct\Direct.exe 0905d0737fafaf27658a9f3e5329af50.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0905d0737fafaf27658a9f3e5329af50.exepid process 1588 0905d0737fafaf27658a9f3e5329af50.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
0905d0737fafaf27658a9f3e5329af50.exepid process 1588 0905d0737fafaf27658a9f3e5329af50.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0905d0737fafaf27658a9f3e5329af50.exepid process 2884 0905d0737fafaf27658a9f3e5329af50.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0905d0737fafaf27658a9f3e5329af50.exe0905d0737fafaf27658a9f3e5329af50.exedescription pid process target process PID 2884 wrote to memory of 1588 2884 0905d0737fafaf27658a9f3e5329af50.exe 0905d0737fafaf27658a9f3e5329af50.exe PID 2884 wrote to memory of 1588 2884 0905d0737fafaf27658a9f3e5329af50.exe 0905d0737fafaf27658a9f3e5329af50.exe PID 2884 wrote to memory of 1588 2884 0905d0737fafaf27658a9f3e5329af50.exe 0905d0737fafaf27658a9f3e5329af50.exe PID 2884 wrote to memory of 1588 2884 0905d0737fafaf27658a9f3e5329af50.exe 0905d0737fafaf27658a9f3e5329af50.exe PID 2884 wrote to memory of 1588 2884 0905d0737fafaf27658a9f3e5329af50.exe 0905d0737fafaf27658a9f3e5329af50.exe PID 2884 wrote to memory of 1588 2884 0905d0737fafaf27658a9f3e5329af50.exe 0905d0737fafaf27658a9f3e5329af50.exe PID 2884 wrote to memory of 1588 2884 0905d0737fafaf27658a9f3e5329af50.exe 0905d0737fafaf27658a9f3e5329af50.exe PID 2884 wrote to memory of 1588 2884 0905d0737fafaf27658a9f3e5329af50.exe 0905d0737fafaf27658a9f3e5329af50.exe PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE PID 1588 wrote to memory of 1240 1588 0905d0737fafaf27658a9f3e5329af50.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0905d0737fafaf27658a9f3e5329af50.exe"C:\Users\Admin\AppData\Local\Temp\0905d0737fafaf27658a9f3e5329af50.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0905d0737fafaf27658a9f3e5329af50.exe
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1240-16-0x00000000025A0000-0x00000000025A1000-memory.dmpFilesize
4KB
-
memory/1588-2-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1588-4-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1588-5-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1588-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1588-8-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1588-10-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1588-12-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1588-11-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1588-310-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2164-262-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2164-264-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB