Analysis

  • max time kernel
    44s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2022, 06:48

General

  • Target

    be16763da84381a64d8811a8e1500229735b0188f323816133d530304d6f46d9.exe

  • Size

    328KB

  • MD5

    704d46ecd47654695575f01184b47519

  • SHA1

    d9f101234ba83455408d4eb71b14575d83a76b5c

  • SHA256

    be16763da84381a64d8811a8e1500229735b0188f323816133d530304d6f46d9

  • SHA512

    3076831fd8450043468b4bfa142b0cf2586597170f8be37df16b3d5cb2b8a6c1f5689abaaf80c2d2792fae1f7607038054bc18b88616e8fc6771a38d443d7bc8

  • SSDEEP

    6144:dPWbPxqiFjSpX7dlcb9o4bLFd+l/f/iLI/yxn/RirzxACw4iFb6g:dOb5qiF2prdlcb3F6kI/isrzxWvR6g

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cybergate15444

C2

danaibrahim.zapto.org:15444

Mutex

3R602X51T6XEV5

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    bader.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Windows can't open this application!

  • message_box_title

    Error

  • password

    14931

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be16763da84381a64d8811a8e1500229735b0188f323816133d530304d6f46d9.exe
    "C:\Users\Admin\AppData\Local\Temp\be16763da84381a64d8811a8e1500229735b0188f323816133d530304d6f46d9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\AppData\Local\Temp\be16763da84381a64d8811a8e1500229735b0188f323816133d530304d6f46d9.exe
      "C:\Users\Admin\AppData\Local\Temp\be16763da84381a64d8811a8e1500229735b0188f323816133d530304d6f46d9.exe" "
      2⤵
        PID:980

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/980-55-0x0000000000400000-0x000000000044F000-memory.dmp

            Filesize

            316KB

          • memory/980-57-0x0000000000400000-0x000000000044F000-memory.dmp

            Filesize

            316KB

          • memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

            Filesize

            8KB