Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 19:15
Static task
static1
Behavioral task
behavioral1
Sample
72d4d13b6e823bb006b7ba7fbb924d2b.exe
Resource
win7-20231129-en
General
-
Target
72d4d13b6e823bb006b7ba7fbb924d2b.exe
-
Size
551KB
-
MD5
72d4d13b6e823bb006b7ba7fbb924d2b
-
SHA1
df685fdee7060dd7cea0ec3b895387339db894f7
-
SHA256
453453f3eea0893aa478d7bd49b3cd8a93044798496968c3cc047f6055117c45
-
SHA512
a6d5454b6cfd47d0819ffbbf865d34248e9712a2b78d289c08b722af039334d21b308e976d0b025ef2906f1447b03d217d99de52cc4db060c2adec7a1d0a5bfd
-
SSDEEP
12288:9M5CPW7GdycHVKsM3LHPknT9x/dbKqmkImjX0CelVd8RfwFvkGE+5w86I/z:y5C+CV1KpbHMJxFKqmkImjECwV0Y2G7d
Malware Config
Extracted
cybergate
v1.21.1
victime
127.0.0.1:81
LC3QE36R0O53R1
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
windir
-
install_file
photos.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
password
arnaud1980
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windir\\photos.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windir\\photos.exe" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{2650M1X6-JF75-VSCA-4C67-RG7V07J255JE} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2650M1X6-JF75-VSCA-4C67-RG7V07J255JE}\StubPath = "C:\\Windows\\system32\\windir\\photos.exe Restart" explorer.exe -
Executes dropped EXE 5 IoCs
Processes:
xgh2858.tmpxgh2858.tmp6r471A7.tmpexplorer.exeexplorer.exepid process 2372 xgh2858.tmp 2736 xgh2858.tmp 2160 6r471A7.tmp 3028 explorer.exe 1048 explorer.exe -
Loads dropped DLL 5 IoCs
Processes:
72d4d13b6e823bb006b7ba7fbb924d2b.exexgh2858.tmpexplorer.exepid process 2648 72d4d13b6e823bb006b7ba7fbb924d2b.exe 2372 xgh2858.tmp 2372 xgh2858.tmp 2372 xgh2858.tmp 3028 explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exe6r471A7.tmpdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\windir\\photos.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\windir\\photos.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\72d4d13b6e823bb006b7ba7fbb924d2b.exe\"" 6r471A7.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\72d4d13b6e823bb006b7ba7fbb924d2b.exe\"" 6r471A7.tmp -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exedescription ioc process File created C:\Windows\SysWOW64\windir\photos.exe explorer.exe File opened for modification C:\Windows\SysWOW64\windir\photos.exe explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
xgh2858.tmpdescription pid process target process PID 2372 set thread context of 3028 2372 xgh2858.tmp explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
explorer.exepid process 3028 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
explorer.exepid process 3028 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
72d4d13b6e823bb006b7ba7fbb924d2b.exexgh2858.tmpexplorer.exedescription pid process target process PID 2648 wrote to memory of 2372 2648 72d4d13b6e823bb006b7ba7fbb924d2b.exe xgh2858.tmp PID 2648 wrote to memory of 2372 2648 72d4d13b6e823bb006b7ba7fbb924d2b.exe xgh2858.tmp PID 2648 wrote to memory of 2372 2648 72d4d13b6e823bb006b7ba7fbb924d2b.exe xgh2858.tmp PID 2648 wrote to memory of 2372 2648 72d4d13b6e823bb006b7ba7fbb924d2b.exe xgh2858.tmp PID 2372 wrote to memory of 2736 2372 xgh2858.tmp xgh2858.tmp PID 2372 wrote to memory of 2736 2372 xgh2858.tmp xgh2858.tmp PID 2372 wrote to memory of 2736 2372 xgh2858.tmp xgh2858.tmp PID 2372 wrote to memory of 2736 2372 xgh2858.tmp xgh2858.tmp PID 2372 wrote to memory of 2160 2372 xgh2858.tmp 6r471A7.tmp PID 2372 wrote to memory of 2160 2372 xgh2858.tmp 6r471A7.tmp PID 2372 wrote to memory of 2160 2372 xgh2858.tmp 6r471A7.tmp PID 2372 wrote to memory of 2160 2372 xgh2858.tmp 6r471A7.tmp PID 2372 wrote to memory of 3028 2372 xgh2858.tmp explorer.exe PID 2372 wrote to memory of 3028 2372 xgh2858.tmp explorer.exe PID 2372 wrote to memory of 3028 2372 xgh2858.tmp explorer.exe PID 2372 wrote to memory of 3028 2372 xgh2858.tmp explorer.exe PID 2372 wrote to memory of 3028 2372 xgh2858.tmp explorer.exe PID 2372 wrote to memory of 3028 2372 xgh2858.tmp explorer.exe PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE PID 3028 wrote to memory of 1312 3028 explorer.exe Explorer.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\72d4d13b6e823bb006b7ba7fbb924d2b.exe"C:\Users\Admin\AppData\Local\Temp\72d4d13b6e823bb006b7ba7fbb924d2b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xgh2858.tmpC:\Users\Admin\AppData\Local\Temp\xgh2858.tmp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xgh2858.tmpC:\Users\Admin\AppData\Local\Temp\xgh2858.tmp3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6r471A7.tmpC:\Users\Admin\AppData\Local\Temp\6r471A7.tmp "C:\Users\Admin\AppData\Local\Temp\72d4d13b6e823bb006b7ba7fbb924d2b.exe" 3 update update3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeC:\Users\Admin\AppData\Local\Temp\explorer.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeexplorer.exe4⤵
- Executes dropped EXE
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\6r471A7.tmpFilesize
36KB
MD5e9c371ac1d323f0b877cc749ecf2beda
SHA159dbc3bdadc96fd4055bb673db56f708d9dc54d5
SHA2564b2751f81acdaad980c873fd1dbdc75bdbb44d51075fdead4a439d3acfa82629
SHA5125bb6adf29b2afee3bdec4db9aea31f010ffb2632169a6a1a72a7331c006de864316f60bc304ad93a7f79455e31bfbda1f83ce413734c8a60bc03b3d5ec7062cb
-
\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
40KB
MD53ede86e285c7ace4723a1bfe1c9517f0
SHA1bf690ffc66dc6f225475608883a2991295d271b4
SHA25624357e47f97dafe2df9e0870cbe9061f167450fdac239ffa0f3f0d2539050ff1
SHA51234507944688b2f8f0ea74933cb0c70f97940aa609a8d0e359c54a6dc9097d9bf607b9aad5d3c6c115e0576ee8dea8e12baf3a98630666f66dae5a3a2b1e92319
-
\Users\Admin\AppData\Local\Temp\xgh2858.tmpFilesize
75KB
MD545cb258585b6c913a8a0739172adddfc
SHA12137a4f1a87e54edef32254249209216112884e6
SHA2563a7dd64ce6323b54e18821bc27c013143943f7f0d26725195d96bb99c18f3a06
SHA512b18d95ba8970075b020c2bc06b48b4de589b6d87ae8693e9f1e191e71a8f4d66867936cc7e5be449b901c695566510b544f487991cc0f7980348a75a5c2648c6
-
memory/1048-260-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/1312-18-0x0000000002F20000-0x0000000002F21000-memory.dmpFilesize
4KB
-
memory/3028-9-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3028-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3028-10-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3028-13-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3028-12-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3028-14-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3028-263-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB