Analysis

  • max time kernel
    152s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2022, 15:09

General

  • Target

    db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e.exe

  • Size

    283KB

  • MD5

    74e8eae2ae39d73191ceb12539331200

  • SHA1

    4c19d984984d8396f0835bdf2e086a903bdf24c8

  • SHA256

    db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e

  • SHA512

    bb0eb1e5f36a817ffce5cb3af9c6ba6339f8142aa10ee849a04a8f20a2f25b4c888e076dd2739e4b6e3af310c1eb1c8178af4c908276de6a997d868cc77afdcf

  • SSDEEP

    6144:TmcD66RRjJ5JGmrpQsK3RD2u270jupCJsCxCl:qcD663UZ2zkPaCxe

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

HackeaDo

C2

127.0.0.1:2000

127.0.0.1:3333

127.0.0.1:4000

Mutex

Explorer

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft

  • install_file

    Explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    FUNFOU

  • message_box_title

    FUNFOU

  • password

    123

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e.exe
    "C:\Users\Admin\AppData\Local\Temp\db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e.exe
      "C:\Users\Admin\AppData\Local\Temp\db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:908
      • C:\Microsoft\Explorer.exe
        "C:\Microsoft\Explorer.exe"
        3⤵
        • Executes dropped EXE
        PID:1828

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Microsoft\Explorer.exe

          Filesize

          283KB

          MD5

          74e8eae2ae39d73191ceb12539331200

          SHA1

          4c19d984984d8396f0835bdf2e086a903bdf24c8

          SHA256

          db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e

          SHA512

          bb0eb1e5f36a817ffce5cb3af9c6ba6339f8142aa10ee849a04a8f20a2f25b4c888e076dd2739e4b6e3af310c1eb1c8178af4c908276de6a997d868cc77afdcf

        • C:\Microsoft\Explorer.exe

          Filesize

          283KB

          MD5

          74e8eae2ae39d73191ceb12539331200

          SHA1

          4c19d984984d8396f0835bdf2e086a903bdf24c8

          SHA256

          db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e

          SHA512

          bb0eb1e5f36a817ffce5cb3af9c6ba6339f8142aa10ee849a04a8f20a2f25b4c888e076dd2739e4b6e3af310c1eb1c8178af4c908276de6a997d868cc77afdcf

        • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

          Filesize

          229KB

          MD5

          fe4519c6ee02ef611ca7136e6736d2d9

          SHA1

          2d6ccfc1b255fe5152f47f45163faa05a30ed9eb

          SHA256

          0eed65b198f552bde5ec9c075060463fcf33167112ba6a5856ede20047f94e1a

          SHA512

          1849f7923ad1fee7af03fb842521bb1ebbbe4778ad15cef0e932b75fe60faec63236476c23c23210d5cf63865008e3246972e6cbb740d83324a9859907f01b6a

        • \Microsoft\Explorer.exe

          Filesize

          283KB

          MD5

          74e8eae2ae39d73191ceb12539331200

          SHA1

          4c19d984984d8396f0835bdf2e086a903bdf24c8

          SHA256

          db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e

          SHA512

          bb0eb1e5f36a817ffce5cb3af9c6ba6339f8142aa10ee849a04a8f20a2f25b4c888e076dd2739e4b6e3af310c1eb1c8178af4c908276de6a997d868cc77afdcf

        • \Microsoft\Explorer.exe

          Filesize

          283KB

          MD5

          74e8eae2ae39d73191ceb12539331200

          SHA1

          4c19d984984d8396f0835bdf2e086a903bdf24c8

          SHA256

          db62f41251200fed105c8c32c0d56a0950c20ee3b9027f255f597b567b39b91e

          SHA512

          bb0eb1e5f36a817ffce5cb3af9c6ba6339f8142aa10ee849a04a8f20a2f25b4c888e076dd2739e4b6e3af310c1eb1c8178af4c908276de6a997d868cc77afdcf

        • memory/908-63-0x0000000024010000-0x0000000024072000-memory.dmp

          Filesize

          392KB

        • memory/908-61-0x0000000024010000-0x0000000024072000-memory.dmp

          Filesize

          392KB

        • memory/908-71-0x0000000024010000-0x0000000024072000-memory.dmp

          Filesize

          392KB

        • memory/908-72-0x0000000024010000-0x0000000024072000-memory.dmp

          Filesize

          392KB

        • memory/2016-58-0x0000000024010000-0x0000000024072000-memory.dmp

          Filesize

          392KB

        • memory/2016-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

          Filesize

          8KB