Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 22:45
Static task
static1
Behavioral task
behavioral1
Sample
a4c80da4456d75d5872a268ab8868ebd.exe
Resource
win7-20240221-en
General
-
Target
a4c80da4456d75d5872a268ab8868ebd.exe
-
Size
1.2MB
-
MD5
a4c80da4456d75d5872a268ab8868ebd
-
SHA1
cd2fa0dbcc378a5e2177519581ff4b77f748492e
-
SHA256
ff13ecd6437c5a18be712dcee48bc44163a3b3ea40b41a108b8c6bf791dfa1a9
-
SHA512
48fdb681f54ae1fb5f5315c6e4936e815e0a5e85fcd527eb66f0b8b6194f68d248d8be38efe15b3aba578e5e79539b3e75b135b713d7fdc3ae1a477ef6f2dba6
-
SSDEEP
24576:jzOyLPD5enV33cWBw342LPrYEO+pY46NA6c1YSkfI:jzzL7Kt3PWJTrYEO+246Dc1cQ
Malware Config
Extracted
cybergate
2.7 Final
vítima
cazador2000.no-ip.biz:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
driver video.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
a4c80da4456d75d5872a268ab8868ebd.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run a4c80da4456d75d5872a268ab8868ebd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\driver video.exe" a4c80da4456d75d5872a268ab8868ebd.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run a4c80da4456d75d5872a268ab8868ebd.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\driver video.exe" a4c80da4456d75d5872a268ab8868ebd.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
a4c80da4456d75d5872a268ab8868ebd.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Q6JG5S3-E42V-IY35-GW6R-587JLYVSE8VW} a4c80da4456d75d5872a268ab8868ebd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Q6JG5S3-E42V-IY35-GW6R-587JLYVSE8VW}\StubPath = "c:\\dir\\install\\install\\driver video.exe Restart" a4c80da4456d75d5872a268ab8868ebd.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule behavioral1/files/0x000b00000001224c-2.dat acprotect -
Loads dropped DLL 1 IoCs
Processes:
a4c80da4456d75d5872a268ab8868ebd.exepid Process 2224 a4c80da4456d75d5872a268ab8868ebd.exe -
Processes:
resource yara_rule behavioral1/memory/2844-10-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2844-11-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2844-12-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2844-15-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2844-19-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2844-22-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2844-23-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2844-2709-0x0000000000400000-0x00000000004AE000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a4c80da4456d75d5872a268ab8868ebd.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\dir\\install\\install\\driver video.exe" a4c80da4456d75d5872a268ab8868ebd.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\dir\\install\\install\\driver video.exe" a4c80da4456d75d5872a268ab8868ebd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a4c80da4456d75d5872a268ab8868ebd.exedescription pid Process procid_target PID 2224 set thread context of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a4c80da4456d75d5872a268ab8868ebd.exepid Process 2844 a4c80da4456d75d5872a268ab8868ebd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
a4c80da4456d75d5872a268ab8868ebd.exepid Process 2844 a4c80da4456d75d5872a268ab8868ebd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a4c80da4456d75d5872a268ab8868ebd.exepid Process 2224 a4c80da4456d75d5872a268ab8868ebd.exe 2224 a4c80da4456d75d5872a268ab8868ebd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a4c80da4456d75d5872a268ab8868ebd.exea4c80da4456d75d5872a268ab8868ebd.exedescription pid Process procid_target PID 2224 wrote to memory of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 PID 2224 wrote to memory of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 PID 2224 wrote to memory of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 PID 2224 wrote to memory of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 PID 2224 wrote to memory of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 PID 2224 wrote to memory of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 PID 2224 wrote to memory of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 PID 2224 wrote to memory of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 PID 2224 wrote to memory of 2844 2224 a4c80da4456d75d5872a268ab8868ebd.exe 28 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11 PID 2844 wrote to memory of 1264 2844 a4c80da4456d75d5872a268ab8868ebd.exe 11
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\a4c80da4456d75d5872a268ab8868ebd.exe"C:\Users\Admin\AppData\Local\Temp\a4c80da4456d75d5872a268ab8868ebd.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\a4c80da4456d75d5872a268ab8868ebd.exeC:\Users\Admin\AppData\Local\Temp\a4c80da4456d75d5872a268ab8868ebd.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵PID:1796
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9