Analysis

  • max time kernel
    150s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2022 03:33

General

  • Target

    eca370714cffc52def1b513f8813c771bdb4735c4063498cd81ab42bd452ae2b.exe

  • Size

    336KB

  • MD5

    69d0cba10d41ffaded42a429d339c5a5

  • SHA1

    30f6aac8ba2883f098d23d2448b52dc4592fdec6

  • SHA256

    eca370714cffc52def1b513f8813c771bdb4735c4063498cd81ab42bd452ae2b

  • SHA512

    51e6e9e3d4590b75e0f805805450a15eb8ef25f94121c9031598ba79312f02ec156f9fee840f4d4b8607955896f1e37045587d4b4a85b925b36c460dd52937f2

  • SSDEEP

    6144:qOpslFlqphdBCkWYxuukP1pjSKSNVkq/MVJb3D68ws:qwslWTBd47GLRMTb3D68ws

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Test

C2

nekisamja.no-ip.biz:85

127.0.0.1:999

Mutex

L38D5PV8S47081

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    156577_a

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eca370714cffc52def1b513f8813c771bdb4735c4063498cd81ab42bd452ae2b.exe
    "C:\Users\Admin\AppData\Local\Temp\eca370714cffc52def1b513f8813c771bdb4735c4063498cd81ab42bd452ae2b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1328
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:884
        • C:\Users\Admin\AppData\Local\Temp\server.exe
          "C:\Users\Admin\AppData\Local\Temp\server.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:856
          • C:\Windows\SysWOW64\install\explorer.exe
            "C:\Windows\system32\install\explorer.exe"
            4⤵
            • Executes dropped EXE
            PID:440

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

      Filesize

      224KB

      MD5

      c0a1f8fd298a75bde9a1cc0c9677f4e9

      SHA1

      e8d8a8c6397e1ea6b0caf3f72c875e1faacfe3fc

      SHA256

      ae32052942756e2e3ddaa13514583df7a8a90389fe71df591c95324638825be8

      SHA512

      edac4cd3a670c9aa0c897d0c0727ffceb8ff936c2011141976185736376fcea827369aee7b90f532bb806843de638f2509997cf15569958a53140051406785e3

    • C:\Users\Admin\AppData\Local\Temp\server.exe

      Filesize

      296KB

      MD5

      2a244f64f229c38e3e17b0e1afa43461

      SHA1

      dd8537e3f47b71c3981c8d21c01148386d7ff4f2

      SHA256

      56b8f88b352dd1632966e032ff2e1aebdb84bf8cd706bae8936035459157315c

      SHA512

      4e350ee723dc59fdd5a07705e5f77b54bf9f0fbbfaba8395fa063cecdad48daece3a8438facc8ee9bb286ebe946f5fd5434a4e965f3fe6bc789349d4e5410b84

    • C:\Users\Admin\AppData\Local\Temp\server.exe

      Filesize

      296KB

      MD5

      2a244f64f229c38e3e17b0e1afa43461

      SHA1

      dd8537e3f47b71c3981c8d21c01148386d7ff4f2

      SHA256

      56b8f88b352dd1632966e032ff2e1aebdb84bf8cd706bae8936035459157315c

      SHA512

      4e350ee723dc59fdd5a07705e5f77b54bf9f0fbbfaba8395fa063cecdad48daece3a8438facc8ee9bb286ebe946f5fd5434a4e965f3fe6bc789349d4e5410b84

    • C:\Users\Admin\AppData\Local\Temp\server.exe

      Filesize

      296KB

      MD5

      2a244f64f229c38e3e17b0e1afa43461

      SHA1

      dd8537e3f47b71c3981c8d21c01148386d7ff4f2

      SHA256

      56b8f88b352dd1632966e032ff2e1aebdb84bf8cd706bae8936035459157315c

      SHA512

      4e350ee723dc59fdd5a07705e5f77b54bf9f0fbbfaba8395fa063cecdad48daece3a8438facc8ee9bb286ebe946f5fd5434a4e965f3fe6bc789349d4e5410b84

    • C:\Windows\SysWOW64\install\explorer.exe

      Filesize

      296KB

      MD5

      2a244f64f229c38e3e17b0e1afa43461

      SHA1

      dd8537e3f47b71c3981c8d21c01148386d7ff4f2

      SHA256

      56b8f88b352dd1632966e032ff2e1aebdb84bf8cd706bae8936035459157315c

      SHA512

      4e350ee723dc59fdd5a07705e5f77b54bf9f0fbbfaba8395fa063cecdad48daece3a8438facc8ee9bb286ebe946f5fd5434a4e965f3fe6bc789349d4e5410b84

    • C:\Windows\SysWOW64\install\explorer.exe

      Filesize

      296KB

      MD5

      2a244f64f229c38e3e17b0e1afa43461

      SHA1

      dd8537e3f47b71c3981c8d21c01148386d7ff4f2

      SHA256

      56b8f88b352dd1632966e032ff2e1aebdb84bf8cd706bae8936035459157315c

      SHA512

      4e350ee723dc59fdd5a07705e5f77b54bf9f0fbbfaba8395fa063cecdad48daece3a8438facc8ee9bb286ebe946f5fd5434a4e965f3fe6bc789349d4e5410b84

    • \Users\Admin\AppData\Local\Temp\server.exe

      Filesize

      296KB

      MD5

      2a244f64f229c38e3e17b0e1afa43461

      SHA1

      dd8537e3f47b71c3981c8d21c01148386d7ff4f2

      SHA256

      56b8f88b352dd1632966e032ff2e1aebdb84bf8cd706bae8936035459157315c

      SHA512

      4e350ee723dc59fdd5a07705e5f77b54bf9f0fbbfaba8395fa063cecdad48daece3a8438facc8ee9bb286ebe946f5fd5434a4e965f3fe6bc789349d4e5410b84

    • \Windows\SysWOW64\install\explorer.exe

      Filesize

      296KB

      MD5

      2a244f64f229c38e3e17b0e1afa43461

      SHA1

      dd8537e3f47b71c3981c8d21c01148386d7ff4f2

      SHA256

      56b8f88b352dd1632966e032ff2e1aebdb84bf8cd706bae8936035459157315c

      SHA512

      4e350ee723dc59fdd5a07705e5f77b54bf9f0fbbfaba8395fa063cecdad48daece3a8438facc8ee9bb286ebe946f5fd5434a4e965f3fe6bc789349d4e5410b84

    • \Windows\SysWOW64\install\explorer.exe

      Filesize

      296KB

      MD5

      2a244f64f229c38e3e17b0e1afa43461

      SHA1

      dd8537e3f47b71c3981c8d21c01148386d7ff4f2

      SHA256

      56b8f88b352dd1632966e032ff2e1aebdb84bf8cd706bae8936035459157315c

      SHA512

      4e350ee723dc59fdd5a07705e5f77b54bf9f0fbbfaba8395fa063cecdad48daece3a8438facc8ee9bb286ebe946f5fd5434a4e965f3fe6bc789349d4e5410b84

    • memory/856-84-0x0000000010480000-0x00000000104E5000-memory.dmp

      Filesize

      404KB

    • memory/856-73-0x0000000010480000-0x00000000104E5000-memory.dmp

      Filesize

      404KB

    • memory/856-75-0x0000000010480000-0x00000000104E5000-memory.dmp

      Filesize

      404KB

    • memory/856-83-0x0000000010480000-0x00000000104E5000-memory.dmp

      Filesize

      404KB

    • memory/1328-55-0x000007FEF2F70000-0x000007FEF4006000-memory.dmp

      Filesize

      16.6MB

    • memory/1328-59-0x0000000002036000-0x0000000002055000-memory.dmp

      Filesize

      124KB

    • memory/1328-54-0x000007FEF4250000-0x000007FEF4C73000-memory.dmp

      Filesize

      10.1MB

    • memory/1392-70-0x0000000010480000-0x00000000104E5000-memory.dmp

      Filesize

      404KB

    • memory/1392-58-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

      Filesize

      8KB

    • memory/1392-62-0x0000000010410000-0x0000000010475000-memory.dmp

      Filesize

      404KB