Analysis

  • max time kernel
    153s
  • max time network
    71s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2022 02:11

General

  • Target

    132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe

  • Size

    360KB

  • MD5

    0330a696267954b7275e21a212bd2f57

  • SHA1

    571b836c812966bdcb0b0763701d3f98fe897b49

  • SHA256

    132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

  • SHA512

    4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

  • SSDEEP

    6144:IpF1STMpQsuSZve2vkzYCiS0V/u6MVrV22jA/yMnS2tkal4d9qsW:Ip1QsuseOkzYTR5UVM2jAnSylfR

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

victima

C2

goldemadbeta.zapto.org:4662

Mutex

173212I5YMGHA1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system

  • install_file

    windll.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    ctfmon

  • regkey_hklm

    ctfmon

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1376
      • C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe
        "C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe
          "C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            • Suspicious use of AdjustPrivilegeToken
            PID:1076
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:1532
            • C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe
              "C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe"
              4⤵
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:564
              • C:\Windows\SysWOW64\system\windll.exe
                "C:\Windows\system32\system\windll.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:1004
                • C:\Windows\SysWOW64\system\windll.exe
                  "C:\Windows\SysWOW64\system\windll.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:1932

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      3
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Admin2.txt
        Filesize

        224KB

        MD5

        f04878c0a536673db73fcfb61af210fb

        SHA1

        111be31caffa02893d227632bea22676012b2cd2

        SHA256

        869b07b667d450731f4cc9453451a828ede976118008d9ed641455126fb5c996

        SHA512

        40e3827207ec542dbb4fabf1176bd71cef5346a957beaa8eade488ad0b0b267a0039ac71a7a6d6348a398e4791a46d986cd7dd98c95dcd7db84f087620319f89

      • C:\Windows\SysWOW64\system\windll.exe
        Filesize

        360KB

        MD5

        0330a696267954b7275e21a212bd2f57

        SHA1

        571b836c812966bdcb0b0763701d3f98fe897b49

        SHA256

        132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

        SHA512

        4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

      • C:\Windows\SysWOW64\system\windll.exe
        Filesize

        360KB

        MD5

        0330a696267954b7275e21a212bd2f57

        SHA1

        571b836c812966bdcb0b0763701d3f98fe897b49

        SHA256

        132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

        SHA512

        4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

      • C:\Windows\SysWOW64\system\windll.exe
        Filesize

        360KB

        MD5

        0330a696267954b7275e21a212bd2f57

        SHA1

        571b836c812966bdcb0b0763701d3f98fe897b49

        SHA256

        132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

        SHA512

        4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

      • \Windows\SysWOW64\system\windll.exe
        Filesize

        360KB

        MD5

        0330a696267954b7275e21a212bd2f57

        SHA1

        571b836c812966bdcb0b0763701d3f98fe897b49

        SHA256

        132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

        SHA512

        4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

      • \Windows\SysWOW64\system\windll.exe
        Filesize

        360KB

        MD5

        0330a696267954b7275e21a212bd2f57

        SHA1

        571b836c812966bdcb0b0763701d3f98fe897b49

        SHA256

        132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

        SHA512

        4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

      • memory/564-110-0x0000000010560000-0x00000000105C5000-memory.dmp
        Filesize

        404KB

      • memory/564-108-0x0000000010560000-0x00000000105C5000-memory.dmp
        Filesize

        404KB

      • memory/564-93-0x0000000010560000-0x00000000105C5000-memory.dmp
        Filesize

        404KB

      • memory/564-86-0x0000000000000000-mapping.dmp
      • memory/1004-97-0x0000000000000000-mapping.dmp
      • memory/1076-80-0x0000000010480000-0x00000000104E5000-memory.dmp
        Filesize

        404KB

      • memory/1076-71-0x0000000074C21000-0x0000000074C23000-memory.dmp
        Filesize

        8KB

      • memory/1076-77-0x0000000010480000-0x00000000104E5000-memory.dmp
        Filesize

        404KB

      • memory/1076-69-0x0000000000000000-mapping.dmp
      • memory/1376-66-0x0000000010410000-0x0000000010475000-memory.dmp
        Filesize

        404KB

      • memory/1644-61-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/1644-58-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/1644-56-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/1644-94-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/1644-72-0x0000000010480000-0x00000000104E5000-memory.dmp
        Filesize

        404KB

      • memory/1644-63-0x0000000010410000-0x0000000010475000-memory.dmp
        Filesize

        404KB

      • memory/1644-88-0x0000000010560000-0x00000000105C5000-memory.dmp
        Filesize

        404KB

      • memory/1644-60-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/1644-82-0x00000000104F0000-0x0000000010555000-memory.dmp
        Filesize

        404KB

      • memory/1644-59-0x0000000075FB1000-0x0000000075FB3000-memory.dmp
        Filesize

        8KB

      • memory/1644-57-0x000000000040E1A8-mapping.dmp
      • memory/1932-102-0x000000000040E1A8-mapping.dmp
      • memory/1932-107-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/1932-109-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/1932-106-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB