Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21-01-2024 12:12
Static task
static1
Behavioral task
behavioral1
Sample
6d47ef95105c1c8693068ad67a8f808b.exe
Resource
win7-20231215-en
General
-
Target
6d47ef95105c1c8693068ad67a8f808b.exe
-
Size
476KB
-
MD5
6d47ef95105c1c8693068ad67a8f808b
-
SHA1
b3745e7aa74afdc67dbc6fea73e0a621317f05b1
-
SHA256
5787915613ee1a82d52bc8ea08b1eb005552a86e32d213d0684351c2786dedce
-
SHA512
50a857ad36b2c22a53f67a756cfad4f379cf733f01c5f80f7a2bdbb90c2b0c4b3c3bc132ba894f546782e2c85c717cf6454ab2d46aa0609931a935abe058c6a2
-
SSDEEP
12288:Kl3yiHcOCHwchidPo2bU5J4oJBHQWVKjKzRiFM:KlCiUHwW2bU5jBHbwzM
Malware Config
Extracted
cybergate
2.6
Microsoft
127.0.0.1:4069
system
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
Microsoft
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Kill Dnd And Block
-
message_box_title
paltalk
-
password
111122
-
regkey_hkcu
system
-
regkey_hklm
system
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
6d47ef95105c1c8693068ad67a8f808b.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 6d47ef95105c1c8693068ad67a8f808b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\system = "C:\\Windows\\system32\\Microsoft\\svchost.exe" 6d47ef95105c1c8693068ad67a8f808b.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 6d47ef95105c1c8693068ad67a8f808b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\system = "C:\\Windows\\system32\\Microsoft\\svchost.exe" 6d47ef95105c1c8693068ad67a8f808b.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
6d47ef95105c1c8693068ad67a8f808b.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{MG7LNVES-4RAQ-2WX3-58C0-B342XF18143O} 6d47ef95105c1c8693068ad67a8f808b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{MG7LNVES-4RAQ-2WX3-58C0-B342XF18143O}\StubPath = "C:\\Windows\\system32\\Microsoft\\svchost.exe Restart" 6d47ef95105c1c8693068ad67a8f808b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6d47ef95105c1c8693068ad67a8f808b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\Microsoft\\svchost.exe" 6d47ef95105c1c8693068ad67a8f808b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\Microsoft\\svchost.exe" 6d47ef95105c1c8693068ad67a8f808b.exe -
Drops file in System32 directory 5 IoCs
Processes:
6d47ef95105c1c8693068ad67a8f808b.exe6d47ef95105c1c8693068ad67a8f808b.exedescription ioc process File created C:\Windows\SysWOW64\Unit-K.dll 6d47ef95105c1c8693068ad67a8f808b.exe File opened for modification C:\Windows\SysWOW64\Unit-K.dll 6d47ef95105c1c8693068ad67a8f808b.exe File created C:\Windows\SysWOW64\Unit-W.dll 6d47ef95105c1c8693068ad67a8f808b.exe File created C:\Windows\SysWOW64\Microsoft\svchost.exe 6d47ef95105c1c8693068ad67a8f808b.exe File opened for modification C:\Windows\SysWOW64\Microsoft\svchost.exe 6d47ef95105c1c8693068ad67a8f808b.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6d47ef95105c1c8693068ad67a8f808b.exe6d47ef95105c1c8693068ad67a8f808b.exedescription pid process target process PID 2364 set thread context of 2052 2364 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2052 set thread context of 2688 2052 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
6d47ef95105c1c8693068ad67a8f808b.exepid process 2688 6d47ef95105c1c8693068ad67a8f808b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
6d47ef95105c1c8693068ad67a8f808b.exepid process 2052 6d47ef95105c1c8693068ad67a8f808b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6d47ef95105c1c8693068ad67a8f808b.exe6d47ef95105c1c8693068ad67a8f808b.exe6d47ef95105c1c8693068ad67a8f808b.exedescription pid process target process PID 2364 wrote to memory of 2052 2364 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2364 wrote to memory of 2052 2364 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2364 wrote to memory of 2052 2364 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2364 wrote to memory of 2052 2364 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2364 wrote to memory of 2052 2364 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2364 wrote to memory of 2052 2364 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2052 wrote to memory of 2688 2052 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2052 wrote to memory of 2688 2052 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2052 wrote to memory of 2688 2052 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2052 wrote to memory of 2688 2052 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2052 wrote to memory of 2688 2052 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2052 wrote to memory of 2688 2052 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2052 wrote to memory of 2688 2052 6d47ef95105c1c8693068ad67a8f808b.exe 6d47ef95105c1c8693068ad67a8f808b.exe PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE PID 2688 wrote to memory of 1076 2688 6d47ef95105c1c8693068ad67a8f808b.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6d47ef95105c1c8693068ad67a8f808b.exe"C:\Users\Admin\AppData\Local\Temp\6d47ef95105c1c8693068ad67a8f808b.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6d47ef95105c1c8693068ad67a8f808b.exeC:\Users\Admin\AppData\Local\Temp\6d47ef95105c1c8693068ad67a8f808b.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6d47ef95105c1c8693068ad67a8f808b.exeC:\Users\Admin\AppData\Local\Temp\6d47ef95105c1c8693068ad67a8f808b.exe4⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1076-43-0x0000000002EF0000-0x0000000002EF1000-memory.dmpFilesize
4KB
-
memory/2052-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2052-36-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/2052-25-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/2052-23-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/2052-21-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/2052-14-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/2052-7-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/2364-13-0x0000000001DD0000-0x0000000001DE0000-memory.dmpFilesize
64KB
-
memory/2364-24-0x0000000074EE0000-0x0000000074FF0000-memory.dmpFilesize
1.1MB
-
memory/2364-19-0x0000000010000000-0x0000000010077000-memory.dmpFilesize
476KB
-
memory/2364-1-0x0000000010000000-0x0000000010077000-memory.dmpFilesize
476KB
-
memory/2364-20-0x0000000001D11000-0x0000000001D15000-memory.dmpFilesize
16KB
-
memory/2364-12-0x00000000773FF000-0x0000000077400000-memory.dmpFilesize
4KB
-
memory/2364-22-0x0000000000260000-0x0000000000299000-memory.dmpFilesize
228KB
-
memory/2364-2-0x0000000000220000-0x0000000000224000-memory.dmpFilesize
16KB
-
memory/2364-10-0x0000000077400000-0x0000000077401000-memory.dmpFilesize
4KB
-
memory/2364-8-0x0000000001D10000-0x0000000001D20000-memory.dmpFilesize
64KB
-
memory/2364-285-0x0000000074EE0000-0x0000000074FF0000-memory.dmpFilesize
1.1MB
-
memory/2364-0-0x0000000010000000-0x0000000010077000-memory.dmpFilesize
476KB
-
memory/2364-4-0x0000000000260000-0x0000000000299000-memory.dmpFilesize
228KB
-
memory/2464-284-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2688-28-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2688-38-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2688-37-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2688-39-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2688-34-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2688-30-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2688-286-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB