Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06-02-2024 21:44
Behavioral task
behavioral1
Sample
958a2e5e1403fedbd871eccd766d2a5a.exe
Resource
win7-20231215-en
General
-
Target
958a2e5e1403fedbd871eccd766d2a5a.exe
-
Size
702KB
-
MD5
958a2e5e1403fedbd871eccd766d2a5a
-
SHA1
3d1758295f30abc013ede4c3a055788c31d957fd
-
SHA256
0fff713f7270efbc649bb056b4b1ee5080fb7651dcdeb14ffb2597928462eecb
-
SHA512
9fecc8bfe3f21c3b6c6a8c968259ce98591fea6652af9f713c555d2830b2eb1af2ab39efe46813bb7b6cd4051f655532f9d799b25733aca7e73f4e3e0cbbf1de
-
SSDEEP
12288:gcD66zQ4dLOSwCDfJqlE6uGiGSAlVLuBRzXA2oAMHVB66EYAUTS9D/ksSzQR:gALtwCc26uGi2VCHXSBzTaDMsAQR
Malware Config
Extracted
cybergate
2.7 Final
vítima
127.0.0.1:81
forcerx.no-ip.biz:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
958a2e5e1403fedbd871eccd766d2a5a.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 958a2e5e1403fedbd871eccd766d2a5a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" 958a2e5e1403fedbd871eccd766d2a5a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 958a2e5e1403fedbd871eccd766d2a5a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\svchost.exe" 958a2e5e1403fedbd871eccd766d2a5a.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
958a2e5e1403fedbd871eccd766d2a5a.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{4A5X66EU-GWC8-6EQY-565J-N82S50I4BU6X} 958a2e5e1403fedbd871eccd766d2a5a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4A5X66EU-GWC8-6EQY-565J-N82S50I4BU6X}\StubPath = "C:\\Windows\\system32\\install\\svchost.exe Restart" 958a2e5e1403fedbd871eccd766d2a5a.exe -
Processes:
resource yara_rule behavioral1/memory/3052-0-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral1/memory/3052-2683-0x0000000000400000-0x00000000004B1000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
958a2e5e1403fedbd871eccd766d2a5a.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\svchost.exe" 958a2e5e1403fedbd871eccd766d2a5a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\svchost.exe" 958a2e5e1403fedbd871eccd766d2a5a.exe -
Drops file in System32 directory 2 IoCs
Processes:
958a2e5e1403fedbd871eccd766d2a5a.exedescription ioc Process File created C:\Windows\SysWOW64\install\svchost.exe 958a2e5e1403fedbd871eccd766d2a5a.exe File opened for modification C:\Windows\SysWOW64\install\svchost.exe 958a2e5e1403fedbd871eccd766d2a5a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
958a2e5e1403fedbd871eccd766d2a5a.exepid Process 3052 958a2e5e1403fedbd871eccd766d2a5a.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
958a2e5e1403fedbd871eccd766d2a5a.exepid Process 3052 958a2e5e1403fedbd871eccd766d2a5a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
958a2e5e1403fedbd871eccd766d2a5a.exedescription pid Process procid_target PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10 PID 3052 wrote to memory of 1212 3052 958a2e5e1403fedbd871eccd766d2a5a.exe 10
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\958a2e5e1403fedbd871eccd766d2a5a.exe"C:\Users\Admin\AppData\Local\Temp\958a2e5e1403fedbd871eccd766d2a5a.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:288
-
-