Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2022, 07:57

General

  • Target

    39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d.exe

  • Size

    643KB

  • MD5

    605a93b30ea97be7640741df15c59f30

  • SHA1

    dd288f8a90e938f790a9d24255a00d8ae7f02095

  • SHA256

    39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d

  • SHA512

    5e25cd0ceece72a6e6621030ef3c6a4bcc48df6bc025c6c9f54348e7b029667a5db46c80d3668a0df9fda38ce1ec673f2d0a15884b006d97ef091d96f27a4093

  • SSDEEP

    12288:Yr6aJ+NTA04rJ2qVdCLimCdPG4tugbedTBd47GLRMTb9:YTJ+y04rJTtxl+d474mf9

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

asnet01

C2

asnet.no-ip.biz:82

Mutex

S7VJ18MU4B2P78

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Windows

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    The windows extension is missing. Please check your Anti virus configuration.

  • message_box_title

    Error...!!!

  • password

    010187

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d.exe
    "C:\Users\Admin\AppData\Local\Temp\39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Users\Admin\AppData\Roaming\msconfig.exe
      "C:\Users\Admin\AppData\Roaming\msconfig.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4784
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        3⤵
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
            PID:2008
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe"
            4⤵
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1960
            • C:\Windows\Windows\svchost.exe
              "C:\Windows\Windows\svchost.exe"
              5⤵
              • Executes dropped EXE
              PID:3092
          • C:\Windows\Windows\svchost.exe
            "C:\Windows\Windows\svchost.exe"
            4⤵
            • Executes dropped EXE
            PID:4544

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Admin2.txt

            Filesize

            224KB

            MD5

            1ebadb23cde4b912c1c8a6513e0a7298

            SHA1

            027149ae8451f959fa04b1dface3f7c1d6c570fa

            SHA256

            7744e9d5735d681c4e09054d15cf899c1f53057191b6b64c2540305c84c5d799

            SHA512

            721941d44292a1a3c7c4b8505da67d402b70ce9160547ee6aaafa0131ed93f7fdd4a9d586357c9232452fecd3414cbe936b55a443b1dceb12f768c3828e09edc

          • C:\Users\Admin\AppData\Roaming\msconfig.exe

            Filesize

            643KB

            MD5

            605a93b30ea97be7640741df15c59f30

            SHA1

            dd288f8a90e938f790a9d24255a00d8ae7f02095

            SHA256

            39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d

            SHA512

            5e25cd0ceece72a6e6621030ef3c6a4bcc48df6bc025c6c9f54348e7b029667a5db46c80d3668a0df9fda38ce1ec673f2d0a15884b006d97ef091d96f27a4093

          • C:\Users\Admin\AppData\Roaming\msconfig.exe

            Filesize

            643KB

            MD5

            605a93b30ea97be7640741df15c59f30

            SHA1

            dd288f8a90e938f790a9d24255a00d8ae7f02095

            SHA256

            39501487b2f9a11ac48cb89bbb60bed7305f1ff057e2d1f0a2c0c8099b5a377d

            SHA512

            5e25cd0ceece72a6e6621030ef3c6a4bcc48df6bc025c6c9f54348e7b029667a5db46c80d3668a0df9fda38ce1ec673f2d0a15884b006d97ef091d96f27a4093

          • C:\Windows\Windows\svchost.exe

            Filesize

            34KB

            MD5

            e118330b4629b12368d91b9df6488be0

            SHA1

            ce90218c7e3b90df2a3409ec253048bb6472c2fd

            SHA256

            3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

            SHA512

            ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

          • C:\Windows\Windows\svchost.exe

            Filesize

            34KB

            MD5

            e118330b4629b12368d91b9df6488be0

            SHA1

            ce90218c7e3b90df2a3409ec253048bb6472c2fd

            SHA256

            3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

            SHA512

            ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

          • C:\Windows\Windows\svchost.exe

            Filesize

            34KB

            MD5

            e118330b4629b12368d91b9df6488be0

            SHA1

            ce90218c7e3b90df2a3409ec253048bb6472c2fd

            SHA256

            3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

            SHA512

            ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

          • memory/1220-153-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/1220-143-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/1220-161-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/1220-145-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/1220-146-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/1220-148-0x0000000010410000-0x0000000010475000-memory.dmp

            Filesize

            404KB

          • memory/1220-142-0x0000000000400000-0x0000000000451000-memory.dmp

            Filesize

            324KB

          • memory/1960-156-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/1960-162-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/1960-165-0x0000000010480000-0x00000000104E5000-memory.dmp

            Filesize

            404KB

          • memory/3420-135-0x00000000750E0000-0x0000000075691000-memory.dmp

            Filesize

            5.7MB

          • memory/3420-139-0x00000000750E0000-0x0000000075691000-memory.dmp

            Filesize

            5.7MB

          • memory/4784-140-0x00000000750E0000-0x0000000075691000-memory.dmp

            Filesize

            5.7MB

          • memory/4784-144-0x00000000750E0000-0x0000000075691000-memory.dmp

            Filesize

            5.7MB