Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2022 04:26

General

  • Target

    f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196.exe

  • Size

    482KB

  • MD5

    2d677ed795661959e60196d2892256b0

  • SHA1

    684d7f89ffc1822a10c8824d8c8da7079eca292a

  • SHA256

    f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196

  • SHA512

    eb11aa99ec8c1e658941b57a843be6ab8af6ffbee2d613d92d52cc01713505531255e55f5ef2e4d226ded8464c2cc892767b96358b41a545d3dd78bb8068c6f9

  • SSDEEP

    12288:9t2qQ7T6HFn3oRI2h11WoUXuTiN8FhNlJo2:OvyHFn4PBSYRFhny2

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Victima

C2

kbchorizo.no-ip.org:81

infeccioneszc.no-ip.org:81

Mutex

infeccion

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Win32

  • install_file

    winloader.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Your windows is not compatibility! error 503

  • message_box_title

    título da mensagem

  • password

    zc

  • regkey_hkcu

    Placa mother

  • regkey_hklm

    Tarjeta de video

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2720
      • C:\Users\Admin\AppData\Local\Temp\f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196.exe
        "C:\Users\Admin\AppData\Local\Temp\f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\Users\Admin\AppData\Local\Temp\f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196.exe
          C:\Users\Admin\AppData\Local\Temp\f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2920
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:5060
            • C:\Win32\winloader.exe
              "C:\Win32\winloader.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:4404
              • C:\Win32\winloader.exe
                C:\Win32\winloader.exe
                6⤵
                • Executes dropped EXE
                PID:228
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 536
                  7⤵
                  • Program crash
                  PID:4040
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:3188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228
      1⤵
        PID:3584

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      3
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
        Filesize

        229KB

        MD5

        0d636aa26187398d0858250cc1c4c4fa

        SHA1

        b2ccf76344d2d9ad769898e66fa45616466f6527

        SHA256

        b087ceee417c34a825f52c98bba9b3a5eaa828ed5f5074e3750f6b7e76ab106d

        SHA512

        237cc3d0514b75e79b894ccbd24cdfa170850203b9dfe8cb79fc194c797c5fc2db138380e65e44a5a026f849137ec612832b208e8c3ba4db63807d5daa6a6010

      • C:\Win32\winloader.exe
        Filesize

        482KB

        MD5

        2d677ed795661959e60196d2892256b0

        SHA1

        684d7f89ffc1822a10c8824d8c8da7079eca292a

        SHA256

        f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196

        SHA512

        eb11aa99ec8c1e658941b57a843be6ab8af6ffbee2d613d92d52cc01713505531255e55f5ef2e4d226ded8464c2cc892767b96358b41a545d3dd78bb8068c6f9

      • C:\Win32\winloader.exe
        Filesize

        482KB

        MD5

        2d677ed795661959e60196d2892256b0

        SHA1

        684d7f89ffc1822a10c8824d8c8da7079eca292a

        SHA256

        f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196

        SHA512

        eb11aa99ec8c1e658941b57a843be6ab8af6ffbee2d613d92d52cc01713505531255e55f5ef2e4d226ded8464c2cc892767b96358b41a545d3dd78bb8068c6f9

      • C:\Win32\winloader.exe
        Filesize

        482KB

        MD5

        2d677ed795661959e60196d2892256b0

        SHA1

        684d7f89ffc1822a10c8824d8c8da7079eca292a

        SHA256

        f8829e7ec8b6dafa283f5ee01ea265f009f650d1cee1210aef7517408b491196

        SHA512

        eb11aa99ec8c1e658941b57a843be6ab8af6ffbee2d613d92d52cc01713505531255e55f5ef2e4d226ded8464c2cc892767b96358b41a545d3dd78bb8068c6f9

      • memory/228-171-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/228-168-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/228-167-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/228-166-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/228-162-0x0000000000000000-mapping.dmp
      • memory/2920-156-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/2920-137-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/2920-133-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/2920-152-0x00000000240F0000-0x0000000024152000-memory.dmp
        Filesize

        392KB

      • memory/2920-135-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/2920-132-0x0000000000000000-mapping.dmp
      • memory/2920-136-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/2920-138-0x0000000000400000-0x00000000004DD000-memory.dmp
        Filesize

        884KB

      • memory/2920-145-0x0000000024080000-0x00000000240E2000-memory.dmp
        Filesize

        392KB

      • memory/2920-140-0x0000000024010000-0x0000000024072000-memory.dmp
        Filesize

        392KB

      • memory/3188-157-0x00000000240F0000-0x0000000024152000-memory.dmp
        Filesize

        392KB

      • memory/3188-155-0x00000000240F0000-0x0000000024152000-memory.dmp
        Filesize

        392KB

      • memory/3188-170-0x00000000240F0000-0x0000000024152000-memory.dmp
        Filesize

        392KB

      • memory/3188-151-0x0000000000000000-mapping.dmp
      • memory/4404-160-0x0000000000000000-mapping.dmp
      • memory/5060-144-0x0000000000000000-mapping.dmp
      • memory/5060-148-0x0000000024080000-0x00000000240E2000-memory.dmp
        Filesize

        392KB

      • memory/5060-149-0x0000000024080000-0x00000000240E2000-memory.dmp
        Filesize

        392KB

      • memory/5060-169-0x0000000024080000-0x00000000240E2000-memory.dmp
        Filesize

        392KB