Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
05/02/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
9314e39dbce88ec9d402499a770aae1f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9314e39dbce88ec9d402499a770aae1f.exe
Resource
win10v2004-20231222-en
General
-
Target
9314e39dbce88ec9d402499a770aae1f.exe
-
Size
1.3MB
-
MD5
9314e39dbce88ec9d402499a770aae1f
-
SHA1
46447b139669a3b85036df65b921b3a27c64b08b
-
SHA256
05b49a912ad9e25524601da4c363de4eba6cc862d627d51f43cf7f1f1cb39753
-
SHA512
14265efd00e245db926242eb86be2a349ff68a01b41f1c03d06d1e2a7bb6f2ac6724d6ffc9aa1cfa3e2c49aeeaebfb8e3fd349801c2708fade796847728636cb
-
SSDEEP
24576:+RmJkcoQricOIQxiZY1WN+htOSq0CgtOFnOaQtD8EoQh:rJZoQrbTFZY1WN+bOSq0CEVJF8Q
Malware Config
Extracted
cybergate
v1.07.5
january
x1222.zapto.org:81
W7Y87FT11877S3
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Install
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
banshee1
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SYSTEM = "C:\\Windows\\system32\\Install\\svchost.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SYSTEM = "C:\\Windows\\system32\\Install\\svchost.exe" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Q0SCYFX6-EN3T-7VAX-PMQH-4IQQH3V225N7} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Q0SCYFX6-EN3T-7VAX-PMQH-4IQQH3V225N7}\StubPath = "C:\\Windows\\system32\\Install\\svchost.exe Restart" svchost.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3832-0-0x0000000000400000-0x0000000000505000-memory.dmp autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Install\svchost.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Install\svchost.exe svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3832 set thread context of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4348 956 WerFault.exe 83 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 956 svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83 PID 3832 wrote to memory of 956 3832 9314e39dbce88ec9d402499a770aae1f.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\9314e39dbce88ec9d402499a770aae1f.exe"C:\Users\Admin\AppData\Local\Temp\9314e39dbce88ec9d402499a770aae1f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 5323⤵
- Program crash
PID:4348
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 956 -ip 9561⤵PID:1556