Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 02:11

General

  • Target

    1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365.exe

  • Size

    385KB

  • MD5

    03d814ec7f480f5e853828aa67b140a5

  • SHA1

    e13ec9e24a5af82ae0b7cb567ad888955880e86c

  • SHA256

    1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

  • SHA512

    8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

  • SSDEEP

    6144:kGytGByk8gPhzQOTSYRWjbMhWX+GBHhaOXkJ1BnJmgbIIeV172IdLdNZUpg:kGjBLxP/2TWJpmgkN172aN

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

mallboro.zapto.org:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 16 IoCs
  • Executes dropped EXE 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 16 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2616
      • C:\Users\Admin\AppData\Local\Temp\1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365.exe
        "C:\Users\Admin\AppData\Local\Temp\1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1456
        • C:\Users\Admin\AppData\Local\Temp\1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365.exe
          "C:\Users\Admin\AppData\Local\Temp\1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Checks computer location settings
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1648
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Adds policy Run key to start application
            • Modifies Installed Components in the registry
            • Adds Run key to start application
            PID:3660
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\system32\spynet\server.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:4952
              • C:\Windows\SysWOW64\spynet\server.exe
                "C:\Windows\SysWOW64\spynet\server.exe"
                6⤵
                • Adds policy Run key to start application
                • Executes dropped EXE
                • Modifies Installed Components in the registry
                • Checks computer location settings
                • Adds Run key to start application
                • Drops file in System32 directory
                • Suspicious use of FindShellTrayWindow
                PID:4652
                • C:\Users\Admin\AppData\Roaming\spynet\server.exe
                  "C:\Users\Admin\AppData\Roaming\spynet\server.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:1500
                  • C:\Users\Admin\AppData\Roaming\spynet\server.exe
                    "C:\Users\Admin\AppData\Roaming\spynet\server.exe"
                    8⤵
                    • Executes dropped EXE
                    PID:3020
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 532
                      9⤵
                      • Program crash
                      PID:2936
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\system32\spynet\server.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:224
              • C:\Windows\SysWOW64\spynet\server.exe
                "C:\Windows\SysWOW64\spynet\server.exe"
                6⤵
                • Executes dropped EXE
                PID:1676
          • C:\Windows\SysWOW64\spynet\server.exe
            "C:\Windows\system32\spynet\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:1752
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\SysWOW64\spynet\server.exe"
              5⤵
              • Adds policy Run key to start application
              • Executes dropped EXE
              • Modifies Installed Components in the registry
              • Adds Run key to start application
              • Drops file in System32 directory
              PID:1900
              • C:\Windows\SysWOW64\spynet\server.exe
                "C:\Windows\SysWOW64\spynet\server.exe"
                6⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:2808
                • C:\Users\Admin\AppData\Roaming\spynet\server.exe
                  "C:\Users\Admin\AppData\Roaming\spynet\server.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:4596
                  • C:\Users\Admin\AppData\Roaming\spynet\server.exe
                    "C:\Users\Admin\AppData\Roaming\spynet\server.exe"
                    8⤵
                    • Executes dropped EXE
                    PID:2500
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 532
                      9⤵
                      • Program crash
                      PID:2864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3020 -ip 3020
      1⤵
        PID:3700
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2500 -ip 2500
        1⤵
          PID:2204

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

                Filesize

                229KB

                MD5

                b1ef4948f470b5f85d608b1448862fcf

                SHA1

                96aaceb48229d055c89469156f71de5d1e8984d5

                SHA256

                18824ffee2f95c6a6948483ccca7a011c23ab44b11f14b62a4bae7ff2aa62e6e

                SHA512

                553c40d3ec5ac7b756e041acb4dbe52af36c0b5b74f189be552246ea019109e9329512196dd9651e86056a491221f16b8a174ce7d176a720532a42e0d1ed007e

              • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

                Filesize

                229KB

                MD5

                703a4710246706488f49b14da0853e1f

                SHA1

                e4226dc1d0ab1edc855c4ad0589b1f1a350a52d7

                SHA256

                9e4704b2428037f2acc4d0123a9083ffd690ce50aea74ae1b1b1e7c8050de66f

                SHA512

                4d79edefdf98665123ed39d327116b64398c6ca538769eb319aac52ba286ee456b8fd9117c45cd7fef2d1b36163048aaaa0d90706c3d1f9892a22697f0dd596b

              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629973501-4017243118-3254762364-1000\699c4b9cdebca7aaea5193cae8a50098_e32e1c79-b88e-4709-94fb-81034ca3398e

                Filesize

                50B

                MD5

                5b63d4dd8c04c88c0e30e494ec6a609a

                SHA1

                884d5a8bdc25fe794dc22ef9518009dcf0069d09

                SHA256

                4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd

                SHA512

                15ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb

              • C:\Users\Admin\AppData\Roaming\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Users\Admin\AppData\Roaming\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Users\Admin\AppData\Roaming\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Users\Admin\AppData\Roaming\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Users\Admin\AppData\Roaming\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Windows\SysWOW64\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Windows\SysWOW64\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Windows\SysWOW64\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Windows\SysWOW64\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Windows\SysWOW64\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Windows\SysWOW64\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Windows\SysWOW64\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • C:\Windows\SysWOW64\spynet\server.exe

                Filesize

                385KB

                MD5

                03d814ec7f480f5e853828aa67b140a5

                SHA1

                e13ec9e24a5af82ae0b7cb567ad888955880e86c

                SHA256

                1a1abbc308beabfbd18dde45691fbea48da3131a97f52182ebfc7ac8867ec365

                SHA512

                8b7a63db0abc54586c6804d6458fd18d9d054db83d87183e15e457ed32ca47ddebc73424715c8efff8c9efae30342d8aa2beca46c71ff35dcf3ecb741905362e

              • memory/224-196-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB

              • memory/1456-134-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB

              • memory/1456-138-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB

              • memory/1500-217-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB

              • memory/1648-139-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/1648-148-0x0000000024080000-0x00000000240E2000-memory.dmp

                Filesize

                392KB

              • memory/1648-136-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/1648-140-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/1648-141-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/1648-155-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/1648-143-0x0000000024010000-0x0000000024072000-memory.dmp

                Filesize

                392KB

              • memory/1676-199-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/1676-220-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/1752-163-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB

              • memory/1752-178-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB

              • memory/1900-181-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/1900-200-0x0000000024010000-0x0000000024072000-memory.dmp

                Filesize

                392KB

              • memory/1900-204-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/2500-233-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/2808-198-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB

              • memory/2808-207-0x0000000024010000-0x0000000024072000-memory.dmp

                Filesize

                392KB

              • memory/2808-203-0x0000000024010000-0x0000000024072000-memory.dmp

                Filesize

                392KB

              • memory/2808-234-0x0000000024010000-0x0000000024072000-memory.dmp

                Filesize

                392KB

              • memory/3020-221-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/3660-154-0x0000000024080000-0x00000000240E2000-memory.dmp

                Filesize

                392KB

              • memory/3660-151-0x0000000024080000-0x00000000240E2000-memory.dmp

                Filesize

                392KB

              • memory/4596-231-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB

              • memory/4652-210-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/4652-182-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/4952-161-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB

              • memory/4952-176-0x0000000000400000-0x000000000045B000-memory.dmp

                Filesize

                364KB