Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 02:04

General

  • Target

    8d83dce739574a50a0864fbb3c0d6f8797c21305ee16200b9c2ff0ad4569040d.exe

  • Size

    516KB

  • MD5

    2b5f02ac65f14561fcedee693f2bf502

  • SHA1

    bd068680366ffde81ddfe116ec1bb1134dea13cb

  • SHA256

    8d83dce739574a50a0864fbb3c0d6f8797c21305ee16200b9c2ff0ad4569040d

  • SHA512

    bf8ba6182b3794250c554a4eb46a19e5e095c464013d533fb930cc2a02fc25a71e307fb4c02c2828d15937fce243d08a07e53a7d8d50e6cbe6e9f036302a7ba7

  • SSDEEP

    12288:agemE7L51gT6dcCQDNbHJHf87hw89A3CzKacbDQrS:mmE7l1ODNzJk7F9mCzKdDH

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

pislikkene.no-ip.org:82

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2712
      • C:\Users\Admin\AppData\Local\Temp\8d83dce739574a50a0864fbb3c0d6f8797c21305ee16200b9c2ff0ad4569040d.exe
        "C:\Users\Admin\AppData\Local\Temp\8d83dce739574a50a0864fbb3c0d6f8797c21305ee16200b9c2ff0ad4569040d.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Users\Admin\AppData\Local\Temp\8d83dce739574a50a0864fbb3c0d6f8797c21305ee16200b9c2ff0ad4569040d.exe
          C:\Users\Admin\AppData\Local\Temp\8d83dce739574a50a0864fbb3c0d6f8797c21305ee16200b9c2ff0ad4569040d.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4756
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:4648
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1532
            • C:\Windows\SysWOW64\install\Svchost.exe
              "C:\Windows\system32\install\Svchost.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:4636
              • C:\Windows\SysWOW64\install\Svchost.exe
                C:\Windows\SysWOW64\install\Svchost.exe
                6⤵
                • Executes dropped EXE
                PID:3932
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 568
                  7⤵
                  • Program crash
                  PID:2984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3932 -ip 3932
      1⤵
        PID:3752

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

              Filesize

              267KB

              MD5

              567a4f3f6904c27a343b2775f4dbeb95

              SHA1

              fab7a488abc611896257fb0dcbaaa417daa1a9b6

              SHA256

              c98dddacb343e8f745501c52f583a5d25968221c6c22ef9b45e495702cefd35c

              SHA512

              a5112361d0e045d7a3c47edb1c4356406abc2ea8ee54aec96e65737b4f39c4501a4a3a8c9291238da4f14eecaee117dd18ed8ab6cee14d38e2981802ed3d12a7

            • C:\Windows\SysWOW64\install\Svchost.exe

              Filesize

              516KB

              MD5

              2b5f02ac65f14561fcedee693f2bf502

              SHA1

              bd068680366ffde81ddfe116ec1bb1134dea13cb

              SHA256

              8d83dce739574a50a0864fbb3c0d6f8797c21305ee16200b9c2ff0ad4569040d

              SHA512

              bf8ba6182b3794250c554a4eb46a19e5e095c464013d533fb930cc2a02fc25a71e307fb4c02c2828d15937fce243d08a07e53a7d8d50e6cbe6e9f036302a7ba7

            • C:\Windows\SysWOW64\install\Svchost.exe

              Filesize

              516KB

              MD5

              2b5f02ac65f14561fcedee693f2bf502

              SHA1

              bd068680366ffde81ddfe116ec1bb1134dea13cb

              SHA256

              8d83dce739574a50a0864fbb3c0d6f8797c21305ee16200b9c2ff0ad4569040d

              SHA512

              bf8ba6182b3794250c554a4eb46a19e5e095c464013d533fb930cc2a02fc25a71e307fb4c02c2828d15937fce243d08a07e53a7d8d50e6cbe6e9f036302a7ba7

            • C:\Windows\SysWOW64\install\Svchost.exe

              Filesize

              516KB

              MD5

              2b5f02ac65f14561fcedee693f2bf502

              SHA1

              bd068680366ffde81ddfe116ec1bb1134dea13cb

              SHA256

              8d83dce739574a50a0864fbb3c0d6f8797c21305ee16200b9c2ff0ad4569040d

              SHA512

              bf8ba6182b3794250c554a4eb46a19e5e095c464013d533fb930cc2a02fc25a71e307fb4c02c2828d15937fce243d08a07e53a7d8d50e6cbe6e9f036302a7ba7

            • memory/1096-138-0x00000000021D0000-0x0000000002203000-memory.dmp

              Filesize

              204KB

            • memory/1096-136-0x0000000000400000-0x0000000000449A24-memory.dmp

              Filesize

              294KB

            • memory/1532-162-0x00000000240F0000-0x0000000024152000-memory.dmp

              Filesize

              392KB

            • memory/1532-178-0x00000000240F0000-0x0000000024152000-memory.dmp

              Filesize

              392KB

            • memory/1532-160-0x00000000240F0000-0x0000000024152000-memory.dmp

              Filesize

              392KB

            • memory/3932-174-0x0000000000400000-0x0000000000461000-memory.dmp

              Filesize

              388KB

            • memory/3932-176-0x0000000000400000-0x0000000000461000-memory.dmp

              Filesize

              388KB

            • memory/3932-177-0x0000000000400000-0x0000000000461000-memory.dmp

              Filesize

              388KB

            • memory/4636-165-0x0000000000400000-0x0000000000449A24-memory.dmp

              Filesize

              294KB

            • memory/4636-175-0x00000000023C0000-0x00000000023F3000-memory.dmp

              Filesize

              204KB

            • memory/4636-173-0x0000000000400000-0x0000000000449A24-memory.dmp

              Filesize

              294KB

            • memory/4636-166-0x00000000023C0000-0x00000000023F3000-memory.dmp

              Filesize

              204KB

            • memory/4648-151-0x0000000024080000-0x00000000240E2000-memory.dmp

              Filesize

              392KB

            • memory/4648-154-0x0000000024080000-0x00000000240E2000-memory.dmp

              Filesize

              392KB

            • memory/4756-148-0x0000000024080000-0x00000000240E2000-memory.dmp

              Filesize

              392KB

            • memory/4756-161-0x0000000000400000-0x0000000000461000-memory.dmp

              Filesize

              388KB

            • memory/4756-143-0x0000000024010000-0x0000000024072000-memory.dmp

              Filesize

              392KB

            • memory/4756-141-0x0000000000400000-0x0000000000461000-memory.dmp

              Filesize

              388KB

            • memory/4756-157-0x00000000240F0000-0x0000000024152000-memory.dmp

              Filesize

              392KB

            • memory/4756-140-0x0000000000400000-0x0000000000461000-memory.dmp

              Filesize

              388KB

            • memory/4756-139-0x0000000000400000-0x0000000000461000-memory.dmp

              Filesize

              388KB

            • memory/4756-135-0x0000000000400000-0x0000000000461000-memory.dmp

              Filesize

              388KB