Resubmissions
03/02/2025, 21:57
250203-1t5hmsvmat1003/02/2025, 04:37
250203-e896saslgn1031/01/2025, 18:35
250131-w8gmxatmc110Analysis
- max time kernel
437s - max time network
549s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250128-en - resource tags
- submitted
03/02/2025, 04:37
General
- Target bazaar.2020.02/HEUR-Backdoor.MSIL.SpyGate.exe
- Size 58KB
- Sample250203-e896saslgn
- SHA256 aac437030e9124f5a39f58ede1eedf0a786091efbce4fe697b468d7c2d907ac6
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.SpyGate.exe"C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.SpyGate.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 14202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4072 -ip 40721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4072-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp
memory/4072-1-0x0000000000330000-0x0000000000344000-memory.dmp
memory/4072-2-0x0000000004CE0000-0x0000000004D7C000-memory.dmp
memory/4072-3-0x0000000005380000-0x0000000005926000-memory.dmp
memory/4072-4-0x0000000004E70000-0x0000000004F02000-memory.dmp
memory/4072-5-0x0000000004DD0000-0x0000000004DDA000-memory.dmp
memory/4072-6-0x0000000004F70000-0x0000000004FC6000-memory.dmp
memory/4072-7-0x0000000074BF0000-0x00000000753A1000-memory.dmp
memory/4072-10-0x0000000074BF0000-0x00000000753A1000-memory.dmp