Analysis
- max time kernel
151s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
24/01/2024, 09:24
Behavioral task
behavioral1
Sample
71db2ad4a8459f126715d4045a76c8e9.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
General
- Target 71db2ad4a8459f126715d4045a76c8e9.exe
- Size 103KB
- Sample240124-ldjtnsfaa6
- SHA256 dc60e02f636a38a07fc37f058edb0bc32bc83ae5e0642c138327bf6df6c4ca2a
- MD5 71db2ad4a8459f126715d4045a76c8e9
- SHA1 420e260d3419ebac8b1a84c80398f9c1dca67384
- SHA512 7baefec92011c0863313771fc03ceb8d1d6eeb59b0c72397e4c4e105c057e155a5f9433d26aaf340cd173509b43e4f3ca99f95de051668fbb966e9a3cc80f946
- SSDEEP 1536:z3CdG9d/4Dz+lFoGu3Jquk4GBv4VxWwKWO6c3NfFl5Dz5lq+6:LiG9l4elFoNk1B5wKWOTdf5C
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cybergate
Version
-
2.0.1
Botnet
-
vítima
C2
-
127.0.0.1:81
Mutex
-
***MUTEX***
Attributes
-
enable_keylogger
true
-
enable_message_box
false
- ftp_directory
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
- Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{WTWCO682-P6G3-8N4J-5QLY-2C3Q77042034} 71db2ad4a8459f126715d4045a76c8e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{WTWCO682-P6G3-8N4J-5QLY-2C3Q77042034}\StubPath = "c:\\dir\\install\\install\\server.exe Restart" 71db2ad4a8459f126715d4045a76c8e9.exe - Deletes itself 1 IoCs
pid Process 4176 explorer.exe -
resource yara_rule behavioral2/memory/232-3-0x0000000024010000-0x0000000024036000-memory.dmp upx behavioral2/memory/232-39-0x0000000024040000-0x0000000024066000-memory.dmp upx behavioral2/memory/4176-43-0x0000000024040000-0x0000000024066000-memory.dmp upx behavioral2/memory/4176-44-0x0000000024040000-0x0000000024066000-memory.dmp upx behavioral2/memory/4176-47-0x0000000024040000-0x0000000024066000-memory.dmp upx behavioral2/memory/4176-48-0x0000000024040000-0x0000000024066000-memory.dmp upx behavioral2/memory/4176-49-0x0000000024040000-0x0000000024066000-memory.dmp upx behavioral2/memory/4176-55-0x0000000024040000-0x0000000024066000-memory.dmp upx behavioral2/memory/4176-56-0x0000000024040000-0x0000000024066000-memory.dmp upx behavioral2/memory/4176-62-0x0000000024040000-0x0000000024066000-memory.dmp upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\dir\\install\\install\\server.exe" 71db2ad4a8459f126715d4045a76c8e9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\dir\\install\\install\\server.exe" 71db2ad4a8459f126715d4045a76c8e9.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 232 71db2ad4a8459f126715d4045a76c8e9.exe 232 71db2ad4a8459f126715d4045a76c8e9.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4176 explorer.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4176 explorer.exe Token: SeDebugPrivilege 4176 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 232 71db2ad4a8459f126715d4045a76c8e9.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24 PID 232 wrote to memory of 3408 232 71db2ad4a8459f126715d4045a76c8e9.exe 24
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\71db2ad4a8459f126715d4045a76c8e9.exe"C:\Users\Admin\AppData\Local\Temp\71db2ad4a8459f126715d4045a76c8e9.exe"2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Deletes itself
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
- Size 42KB
- SHA256 39f34e3ca334835280494dc885fd7f7298df9a33fd5282e50a7d4e8fda3a4843
- MD5 deb73ebe56cb1aa76a06849f91a5b825
- SHA1 0665e637869c4687c7499482fd3389faf84ba311
- SHA512 981c4b6b40e7922ed089a1cd5eb09a2c3314893730dabae25e20caad53fabca148057dcf022ea55e78286940a5b65fd0cec532fdd2f34d217a21e921c6e07dd1
- SSDEEP 768:oVuATJHEk4GBWU4pPaKzeS4BePKgux6fvm6xW3z5EeFlE70VhAM+U5lq+09:oJuk4GBv4VxWwKWO6c3NfFl5Dz5lq+G
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\logs.dat
- Size 15B
- SHA256 8ac6ea31dd72be422681a7fbdf67a0c2657a957974e2cddad0384d50fadfbd30
- MD5 7ba6003a8895aba16039ad4a2d9f3465
- SHA1 d1a24f8b756d768a304e82fa934dfb6ac3194244
- SHA512 325df2dd25ed5ecf498ea84605544ad2f1741f72be1c18ef41ad7c2b2a3bbd7edeb380b2b1d5507765d9123d3611eccb0be2faf88ff489f1c35193767c223630
- MD5 SHA1 SHA512