Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2022, 07:57

General

  • Target

    39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d.exe

  • Size

    643KB

  • MD5

    605a93b30ea97be7640741df15c59f30

  • SHA1

    dd288f8a90e938f790a9d24255a00d8ae7f02095

  • SHA256

    39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d

  • SHA512

    5e25cd0ceece72a6e6621030ef3c6a4bcc48df6bc025c6c9f54348e7b029667a5db46c80d3668a0df9fda38ce1ec673f2d0a15884b006d97ef091d96f27a4093

  • SSDEEP

    12288:Yr6aJ+NTA04rJ2qVdCLimCdPG4tugbedTBd47GLRMTb9:YTJ+y04rJTtxl+d474mf9

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

asnet01

C2

asnet.no-ip.biz:82

Mutex

S7VJ18MU4B2P78

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Windows

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    The windows extension is missing. Please check your Anti virus configuration.

  • message_box_title

    Error...!!!

  • password

    010187

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d.exe
    "C:\Users\Admin\AppData\Local\Temp\39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Users\Admin\AppData\Roaming\msconfig.exe
      "C:\Users\Admin\AppData\Roaming\msconfig.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        3⤵
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:900
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
            PID:1824
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe"
            4⤵
            • Drops file in Windows directory
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1828
            • C:\Windows\Windows\svchost.exe
              "C:\Windows\Windows\svchost.exe"
              5⤵
              • Executes dropped EXE
              PID:656
          • C:\Windows\Windows\svchost.exe
            "C:\Windows\Windows\svchost.exe"
            4⤵
            • Executes dropped EXE
            PID:328

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

            Filesize

            224KB

            MD5

            1ebadb23cde4b912c1c8a6513e0a7298

            SHA1

            027149ae8451f959fa04b1dface3f7c1d6c570fa

            SHA256

            7744e9d5735d681c4e09054d15cf899c1f53057191b6b64c2540305c84c5d799

            SHA512

            721941d44292a1a3c7c4b8505da67d402b70ce9160547ee6aaafa0131ed93f7fdd4a9d586357c9232452fecd3414cbe936b55a443b1dceb12f768c3828e09edc

          • C:\Users\Admin\AppData\Roaming\msconfig.exe

            Filesize

            643KB

            MD5

            605a93b30ea97be7640741df15c59f30

            SHA1

            dd288f8a90e938f790a9d24255a00d8ae7f02095

            SHA256

            39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d

            SHA512

            5e25cd0ceece72a6e6621030ef3c6a4bcc48df6bc025c6c9f54348e7b029667a5db46c80d3668a0df9fda38ce1ec673f2d0a15884b006d97ef091d96f27a4093

          • C:\Users\Admin\AppData\Roaming\msconfig.exe

            Filesize

            643KB

            MD5

            605a93b30ea97be7640741df15c59f30

            SHA1

            dd288f8a90e938f790a9d24255a00d8ae7f02095

            SHA256

            39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d

            SHA512

            5e25cd0ceece72a6e6621030ef3c6a4bcc48df6bc025c6c9f54348e7b029667a5db46c80d3668a0df9fda38ce1ec673f2d0a15884b006d97ef091d96f27a4093

          • C:\Windows\Windows\svchost.exe

            Filesize

            31KB

            MD5

            ed797d8dc2c92401985d162e42ffa450

            SHA1

            0f02fc517c7facc4baefde4fe9467fb6488ebabe

            SHA256

            b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

            SHA512

            e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

          • C:\Windows\Windows\svchost.exe

            Filesize

            31KB

            MD5

            ed797d8dc2c92401985d162e42ffa450

            SHA1

            0f02fc517c7facc4baefde4fe9467fb6488ebabe

            SHA256

            b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

            SHA512

            e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

          • C:\Windows\Windows\svchost.exe

            Filesize

            31KB

            MD5

            ed797d8dc2c92401985d162e42ffa450

            SHA1

            0f02fc517c7facc4baefde4fe9467fb6488ebabe

            SHA256

            b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

            SHA512

            e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

          • \Users\Admin\AppData\Roaming\msconfig.exe

            Filesize

            643KB

            MD5

            605a93b30ea97be7640741df15c59f30

            SHA1

            dd288f8a90e938f790a9d24255a00d8ae7f02095

            SHA256

            39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d

            SHA512

            5e25cd0ceece72a6e6621030ef3c6a4bcc48df6bc025c6c9f54348e7b029667a5db46c80d3668a0df9fda38ce1ec673f2d0a15884b006d97ef091d96f27a4093

          • \Users\Admin\AppData\Roaming\msconfig.exe

            Filesize

            643KB

            MD5

            605a93b30ea97be7640741df15c59f30

            SHA1

            dd288f8a90e938f790a9d24255a00d8ae7f02095

            SHA256

            39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d

            SHA512

            5e25cd0ceece72a6e6621030ef3c6a4bcc48df6bc025c6c9f54348e7b029667a5db46c80d3668a0df9fda38ce1ec673f2d0a15884b006d97ef091d96f27a4093

          • \Windows\Windows\svchost.exe

            Filesize

            31KB

            MD5

            ed797d8dc2c92401985d162e42ffa450

            SHA1

            0f02fc517c7facc4baefde4fe9467fb6488ebabe

            SHA256

            b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

            SHA512

            e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

          • memory/900-64-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-87-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/900-70-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-68-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-65-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-73-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-96-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-75-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-78-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-79-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-81-0x0000000010410000-0x0000000010475000-memory.dmp

            Filesize

            404KB

          • memory/900-67-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-71-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/900-69-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/1452-54-0x0000000075041000-0x0000000075043000-memory.dmp

            Filesize

            8KB

          • memory/1452-63-0x0000000074550000-0x0000000074AFB000-memory.dmp

            Filesize

            5.7MB

          • memory/1452-55-0x0000000074550000-0x0000000074AFB000-memory.dmp

            Filesize

            5.7MB

          • memory/1828-92-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/1828-90-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/1828-97-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/1828-102-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/2008-76-0x0000000074550000-0x0000000074AFB000-memory.dmp

            Filesize

            5.7MB

          • memory/2008-62-0x0000000074550000-0x0000000074AFB000-memory.dmp

            Filesize

            5.7MB