Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2022, 15:20

General

  • Target

    5fd606928a3cfaa2a83e9ed0788ea101772b3db2cb71ffc9fb3772ef80086ba9.exe

  • Size

    296KB

  • MD5

    69054cec1f89b2168d134a64299fedf7

  • SHA1

    2608a37b0c5f32f914871eacd9ac773118f6ffab

  • SHA256

    5fd606928a3cfaa2a83e9ed0788ea101772b3db2cb71ffc9fb3772ef80086ba9

  • SHA512

    9e8c939cf5e73b8148db2366484ea0d91c49daf024b6868d12c24c0d9ecf84b2622758d4809d8c5b722c7325356436cf89a62041bcb17ca6988e5c4a50cd9e8f

  • SSDEEP

    6144:uOpslFlqvhdBCkWYxuukP1pjSKSNVkq/MVJbq:uwslmTBd47GLRMTbq

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

127.0.0.1:88

Mutex

SC8WYXQ2183C8R

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    12345

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fd606928a3cfaa2a83e9ed0788ea101772b3db2cb71ffc9fb3772ef80086ba9.exe
    "C:\Users\Admin\AppData\Local\Temp\5fd606928a3cfaa2a83e9ed0788ea101772b3db2cb71ffc9fb3772ef80086ba9.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:4768
      • C:\Users\Admin\AppData\Local\Temp\5fd606928a3cfaa2a83e9ed0788ea101772b3db2cb71ffc9fb3772ef80086ba9.exe
        "C:\Users\Admin\AppData\Local\Temp\5fd606928a3cfaa2a83e9ed0788ea101772b3db2cb71ffc9fb3772ef80086ba9.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4052
        • C:\directory\CyberGate\install\server.exe
          "C:\directory\CyberGate\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:1272
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 580
            4⤵
            • Program crash
            PID:5020
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1272 -ip 1272
      1⤵
        PID:1492

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

        Filesize

        224KB

        MD5

        ffe6d3eab3676866925bebe4109fbbab

        SHA1

        7e7974f15bc6db763e98f5a56e4e481cc8c0b389

        SHA256

        d3c3c5ff33d0472acf3d14b9380cfc57b4b7a5529bd3946d1ff8d1924be495f2

        SHA512

        0ff55e08c9afda64e8151c2d630bb924874b9b9cdcc4e7febe27409da5626b40feb4749865cc2dd4224985bd969d5c627187aef128f2227b1d7a8e32f88b0ca6

      • C:\directory\CyberGate\install\server.exe

        Filesize

        296KB

        MD5

        69054cec1f89b2168d134a64299fedf7

        SHA1

        2608a37b0c5f32f914871eacd9ac773118f6ffab

        SHA256

        5fd606928a3cfaa2a83e9ed0788ea101772b3db2cb71ffc9fb3772ef80086ba9

        SHA512

        9e8c939cf5e73b8148db2366484ea0d91c49daf024b6868d12c24c0d9ecf84b2622758d4809d8c5b722c7325356436cf89a62041bcb17ca6988e5c4a50cd9e8f

      • C:\directory\CyberGate\install\server.exe

        Filesize

        296KB

        MD5

        69054cec1f89b2168d134a64299fedf7

        SHA1

        2608a37b0c5f32f914871eacd9ac773118f6ffab

        SHA256

        5fd606928a3cfaa2a83e9ed0788ea101772b3db2cb71ffc9fb3772ef80086ba9

        SHA512

        9e8c939cf5e73b8148db2366484ea0d91c49daf024b6868d12c24c0d9ecf84b2622758d4809d8c5b722c7325356436cf89a62041bcb17ca6988e5c4a50cd9e8f

      • memory/1696-133-0x0000000010410000-0x0000000010475000-memory.dmp

        Filesize

        404KB

      • memory/1696-138-0x0000000010480000-0x00000000104E5000-memory.dmp

        Filesize

        404KB

      • memory/4052-141-0x0000000010480000-0x00000000104E5000-memory.dmp

        Filesize

        404KB

      • memory/4052-142-0x0000000010480000-0x00000000104E5000-memory.dmp

        Filesize

        404KB

      • memory/4052-147-0x0000000010480000-0x00000000104E5000-memory.dmp

        Filesize

        404KB