Overview

overview

10

Static

static

88AB0FB7AA...C1.exe

windows7_x64

10

88AB0FB7AA...C1.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    195s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    12-07-2021 23:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    88AB0FB7AAB828733D7FAD8DD72BA73C7188803ED85C1.exe

  • Size

    1.3MB

  • MD5

    9fb3ef5f9d35773451f983671b2240f0

  • SHA1

    0de17fc90bbae1b1a1db740939dd222b44f433ca

  • SHA256

    88ab0fb7aab828733d7fad8dd72ba73c7188803ed85c19d01a267ad7809cba44

  • SHA512

    f32e742494550b0d8dda6dac6ac28f13b004fb43e782c1358e51a77a8755c152b5713bd524efc487c831462ee93e10b87a68a99b7cff149c257763753eb9d023

Score
10/10
cybergateremotepersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

remote

C2

morcoy.duia.ro:2002

pinguela.dnsd.me:2003

matreto.system-ns.co:2004

palotes12.chickenkiller.com:2005

JOSE4.NO-IP.ORG:2006
Mutex

41S0823EXU0802

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    javaw.exe

  • install_dir

    systemroot

  • install_file

    ms.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    6146

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\88AB0FB7AAB828733D7FAD8DD72BA73C7188803ED85C1.exe
    "C:\Users\Admin\AppData\Local\Temp\88AB0FB7AAB828733D7FAD8DD72BA73C7188803ED85C1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\88AB0FB7AAB828733D7FAD8DD72BA73C7188803ED85C1.exe
      "C:\Users\Admin\AppData\Local\Temp\88AB0FB7AAB828733D7FAD8DD72BA73C7188803ED85C1.exe"
      2⤵
      • Adds policy Run key to start application
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\system32\cscript.exe" "C:\Users\Admin\AppData\Roaming\Adminv1.18.0 - Trial version.vbs"
        3⤵
          PID:1796

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    3
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    3
    T1112

    Credential Access

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Adminv1.18.0 - Trial version.txt
      MD5

      81051bcc2cf1bedf378224b0a93e2877

      SHA1

      ba8ab5a0280b953aa97435ff8946cbcbb2755a27

      SHA256

      7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

      SHA512

      1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Adminv1.18.0 - Trial version.vbs
      MD5

      ec0737a274ceb47d3bd6c37580db325c

      SHA1

      0dfdf4df7298f23570384d0bba0b56d3bff8855d

      SHA256

      a57585a65ad51b6e10fc2b1ba4dd6435167d543302ad1df1260a22859faea597

      SHA512

      7af08cef86f087e66f23bf6d17ad210f02a7659775b932dfdd4745818f6ce8a4b34afa0b686baf03b41b21538f1444e334563d48636e6d2c9ab11bc261bd8cc3

      Download Submit
    • memory/1796-70-0x0000000000000000-mapping.dmp
      Download
    • memory/1884-63-0x0000000000400000-0x000000000044D000-memory.dmp
      Filesize

      308KB

      Download
    • memory/1884-64-0x000000000040A0C4-mapping.dmp
      Download
    • memory/1884-65-0x0000000000400000-0x000000000044D000-memory.dmp
      Filesize

      308KB

      Download
    • memory/1884-66-0x0000000075211000-0x0000000075213000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1884-67-0x0000000001C80000-0x0000000001CF2000-memory.dmp
      Filesize

      456KB

      Download
    • memory/1884-68-0x0000000003220000-0x0000000003262000-memory.dmp
      Filesize

      264KB

      Download
    • memory/1884-69-0x00000000033E0000-0x0000000003422000-memory.dmp
      Filesize

      264KB

      Download