Analysis

  • max time kernel
    158s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2022 02:11

General

  • Target

    132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe

  • Size

    360KB

  • MD5

    0330a696267954b7275e21a212bd2f57

  • SHA1

    571b836c812966bdcb0b0763701d3f98fe897b49

  • SHA256

    132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

  • SHA512

    4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

  • SSDEEP

    6144:IpF1STMpQsuSZve2vkzYCiS0V/u6MVrV22jA/yMnS2tkal4d9qsW:Ip1QsuseOkzYTR5UVM2jAnSylfR

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

victima

C2

goldemadbeta.zapto.org:4662

Mutex

173212I5YMGHA1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system

  • install_file

    windll.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    ctfmon

  • regkey_hklm

    ctfmon

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:724
      • C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe
        "C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe
          "C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3536
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            • Suspicious use of AdjustPrivilegeToken
            PID:3060
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3348
            • C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe
              "C:\Users\Admin\AppData\Local\Temp\132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1304
              • C:\Windows\SysWOW64\system\windll.exe
                "C:\Windows\system32\system\windll.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:4192
                • C:\Windows\SysWOW64\system\windll.exe
                  "C:\Windows\SysWOW64\system\windll.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:2920
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 588
                    7⤵
                    • Program crash
                    PID:3596
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2920 -ip 2920
        1⤵
          PID:3860

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        3
        T1060

        Defense Evasion

        Modify Registry

        3
        T1112

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Admin2.txt
          Filesize

          224KB

          MD5

          f04878c0a536673db73fcfb61af210fb

          SHA1

          111be31caffa02893d227632bea22676012b2cd2

          SHA256

          869b07b667d450731f4cc9453451a828ede976118008d9ed641455126fb5c996

          SHA512

          40e3827207ec542dbb4fabf1176bd71cef5346a957beaa8eade488ad0b0b267a0039ac71a7a6d6348a398e4791a46d986cd7dd98c95dcd7db84f087620319f89

        • C:\Windows\SysWOW64\system\windll.exe
          Filesize

          360KB

          MD5

          0330a696267954b7275e21a212bd2f57

          SHA1

          571b836c812966bdcb0b0763701d3f98fe897b49

          SHA256

          132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

          SHA512

          4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

        • C:\Windows\SysWOW64\system\windll.exe
          Filesize

          360KB

          MD5

          0330a696267954b7275e21a212bd2f57

          SHA1

          571b836c812966bdcb0b0763701d3f98fe897b49

          SHA256

          132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

          SHA512

          4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

        • C:\Windows\SysWOW64\system\windll.exe
          Filesize

          360KB

          MD5

          0330a696267954b7275e21a212bd2f57

          SHA1

          571b836c812966bdcb0b0763701d3f98fe897b49

          SHA256

          132e864c520ee8e5a1ab723d34e122f3f62f60f8920be8bf8b475bd69dd839e2

          SHA512

          4d03d0bab573ff62f83a72cfada4dc578e92b7a7ec87ef306a86166c3f628f569073781d6fa5f17d1794b4f2d4b29e2188d71cd5baa28ec0851f213d44255f05

        • memory/1304-176-0x0000000010560000-0x00000000105C5000-memory.dmp
          Filesize

          404KB

        • memory/1304-158-0x0000000000000000-mapping.dmp
        • memory/1304-163-0x0000000010560000-0x00000000105C5000-memory.dmp
          Filesize

          404KB

        • memory/1304-162-0x0000000010560000-0x00000000105C5000-memory.dmp
          Filesize

          404KB

        • memory/2920-169-0x0000000000000000-mapping.dmp
        • memory/2920-173-0x0000000000400000-0x0000000000451000-memory.dmp
          Filesize

          324KB

        • memory/2920-174-0x0000000000400000-0x0000000000451000-memory.dmp
          Filesize

          324KB

        • memory/2920-175-0x0000000000400000-0x0000000000451000-memory.dmp
          Filesize

          324KB

        • memory/3060-149-0x0000000010480000-0x00000000104E5000-memory.dmp
          Filesize

          404KB

        • memory/3060-145-0x0000000000000000-mapping.dmp
        • memory/3060-152-0x0000000010480000-0x00000000104E5000-memory.dmp
          Filesize

          404KB

        • memory/3536-143-0x0000000000400000-0x0000000000451000-memory.dmp
          Filesize

          324KB

        • memory/3536-159-0x0000000010560000-0x00000000105C5000-memory.dmp
          Filesize

          404KB

        • memory/3536-154-0x00000000104F0000-0x0000000010555000-memory.dmp
          Filesize

          404KB

        • memory/3536-164-0x0000000000400000-0x0000000000451000-memory.dmp
          Filesize

          324KB

        • memory/3536-146-0x0000000010480000-0x00000000104E5000-memory.dmp
          Filesize

          404KB

        • memory/3536-134-0x0000000000000000-mapping.dmp
        • memory/3536-140-0x0000000010410000-0x0000000010475000-memory.dmp
          Filesize

          404KB

        • memory/3536-138-0x0000000000400000-0x0000000000451000-memory.dmp
          Filesize

          324KB

        • memory/3536-137-0x0000000000400000-0x0000000000451000-memory.dmp
          Filesize

          324KB

        • memory/3536-136-0x0000000000400000-0x0000000000451000-memory.dmp
          Filesize

          324KB

        • memory/3536-135-0x0000000000400000-0x0000000000451000-memory.dmp
          Filesize

          324KB

        • memory/4192-165-0x0000000000000000-mapping.dmp