Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 07:01

General

  • Target

    ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe

  • Size

    997KB

  • MD5

    22295ae123a1086892993978dfa74c50

  • SHA1

    34274142a00d1f168a95c54d7a8424469e055773

  • SHA256

    ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f

  • SHA512

    280805ea6bdcb3f89c90704efaac7456e7d1093cd7d4c7c086c44bf487eebc023350851b4bb2c8a5a1b268af781221428cd6fcc2f6bf900b1c5c188d749d78c4

  • SSDEEP

    24576:KeQkTf4+DcWfmk5TyAy3iu5A3t/LIByEnywiebhPb+1GJsN:qkTggcWfmsfuW3pIByEnHNbsGK

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

darknighthacker.no-ip.biz:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:472
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:464
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalService
          2⤵
            PID:836
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
            2⤵
              PID:976
            • C:\Windows\system32\sppsvc.exe
              C:\Windows\system32\sppsvc.exe
              2⤵
                PID:964
              • C:\Windows\system32\taskhost.exe
                "taskhost.exe"
                2⤵
                  PID:1160
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                  2⤵
                    PID:1048
                  • C:\Windows\System32\spoolsv.exe
                    C:\Windows\System32\spoolsv.exe
                    2⤵
                      PID:288
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k NetworkService
                      2⤵
                        PID:300
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs
                        2⤵
                          PID:868
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          2⤵
                            PID:808
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                            2⤵
                              PID:748
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k RPCSS
                              2⤵
                                PID:672
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k DcomLaunch
                                2⤵
                                  PID:592
                                  • C:\Windows\system32\DllHost.exe
                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                    3⤵
                                      PID:1416
                                    • C:\Windows\system32\DllHost.exe
                                      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                      3⤵
                                        PID:1108
                                      • C:\Windows\system32\DllHost.exe
                                        C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                        3⤵
                                          PID:364
                                    • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                                      wmiadap.exe /F /T /R
                                      1⤵
                                        PID:1964
                                      • C:\Windows\Explorer.EXE
                                        C:\Windows\Explorer.EXE
                                        1⤵
                                          PID:1284
                                          • C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe
                                            "C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe"
                                            2⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:1724
                                            • C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe
                                              C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe
                                              3⤵
                                              • Adds policy Run key to start application
                                              • Modifies Installed Components in the registry
                                              • Adds Run key to start application
                                              • Drops file in System32 directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of WriteProcessMemory
                                              PID:1600
                                              • C:\Windows\SysWOW64\explorer.exe
                                                explorer.exe
                                                4⤵
                                                • Modifies Installed Components in the registry
                                                PID:1344
                                              • C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe
                                                "C:\Users\Admin\AppData\Local\Temp\ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f.exe"
                                                4⤵
                                                • Loads dropped DLL
                                                • Drops file in System32 directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: GetForegroundWindowSpam
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1480
                                                • C:\Windows\SysWOW64\windows.exe
                                                  "C:\Windows\system32\windows.exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1932
                                                  • C:\Windows\SysWOW64\windows.exe
                                                    C:\Windows\SysWOW64\windows.exe
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:692
                                        • C:\Windows\system32\Dwm.exe
                                          "C:\Windows\system32\Dwm.exe"
                                          1⤵
                                            PID:1244
                                          • C:\Windows\system32\lsm.exe
                                            C:\Windows\system32\lsm.exe
                                            1⤵
                                              PID:480
                                            • C:\Windows\system32\winlogon.exe
                                              winlogon.exe
                                              1⤵
                                                PID:416
                                              • C:\Windows\system32\csrss.exe
                                                %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                1⤵
                                                  PID:380
                                                • C:\Windows\system32\wininit.exe
                                                  wininit.exe
                                                  1⤵
                                                    PID:368
                                                  • C:\Windows\system32\csrss.exe
                                                    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                    1⤵
                                                      PID:332
                                                    • C:\Windows\System32\smss.exe
                                                      \SystemRoot\System32\smss.exe
                                                      1⤵
                                                        PID:260

                                                      Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

                                                              Filesize

                                                              240KB

                                                              MD5

                                                              69be322be5eb4b1b490fbddc06c00100

                                                              SHA1

                                                              893e3b1bccab769f3be5b46ff2a95f7cc9491510

                                                              SHA256

                                                              7ab3c9e1cbce6d67719c55a9b57e3c98aa713240bd34b3e7a8883c5b96220376

                                                              SHA512

                                                              c532bf71b9cd39d6c281e122b121a56debb5f01aaea9d4373986ceac0c9e83a54287bda71cc65a108c14ca72ba80df9c32f5b2b5e06ddbfd27f8fe11dfd5284c

                                                            • C:\Windows\SysWOW64\windows.exe

                                                              Filesize

                                                              997KB

                                                              MD5

                                                              22295ae123a1086892993978dfa74c50

                                                              SHA1

                                                              34274142a00d1f168a95c54d7a8424469e055773

                                                              SHA256

                                                              ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f

                                                              SHA512

                                                              280805ea6bdcb3f89c90704efaac7456e7d1093cd7d4c7c086c44bf487eebc023350851b4bb2c8a5a1b268af781221428cd6fcc2f6bf900b1c5c188d749d78c4

                                                            • C:\Windows\SysWOW64\windows.exe

                                                              Filesize

                                                              997KB

                                                              MD5

                                                              22295ae123a1086892993978dfa74c50

                                                              SHA1

                                                              34274142a00d1f168a95c54d7a8424469e055773

                                                              SHA256

                                                              ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f

                                                              SHA512

                                                              280805ea6bdcb3f89c90704efaac7456e7d1093cd7d4c7c086c44bf487eebc023350851b4bb2c8a5a1b268af781221428cd6fcc2f6bf900b1c5c188d749d78c4

                                                            • C:\Windows\SysWOW64\windows.exe

                                                              Filesize

                                                              997KB

                                                              MD5

                                                              22295ae123a1086892993978dfa74c50

                                                              SHA1

                                                              34274142a00d1f168a95c54d7a8424469e055773

                                                              SHA256

                                                              ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f

                                                              SHA512

                                                              280805ea6bdcb3f89c90704efaac7456e7d1093cd7d4c7c086c44bf487eebc023350851b4bb2c8a5a1b268af781221428cd6fcc2f6bf900b1c5c188d749d78c4

                                                            • \Windows\SysWOW64\windows.exe

                                                              Filesize

                                                              997KB

                                                              MD5

                                                              22295ae123a1086892993978dfa74c50

                                                              SHA1

                                                              34274142a00d1f168a95c54d7a8424469e055773

                                                              SHA256

                                                              ea978749c1cb50887edf59482191d5344b38010160b230d352b3e4eedcdb842f

                                                              SHA512

                                                              280805ea6bdcb3f89c90704efaac7456e7d1093cd7d4c7c086c44bf487eebc023350851b4bb2c8a5a1b268af781221428cd6fcc2f6bf900b1c5c188d749d78c4

                                                            • memory/692-501-0x0000000031910000-0x000000003191D000-memory.dmp

                                                              Filesize

                                                              52KB

                                                            • memory/692-504-0x0000000000400000-0x0000000000452000-memory.dmp

                                                              Filesize

                                                              328KB

                                                            • memory/692-500-0x0000000000400000-0x0000000000452000-memory.dmp

                                                              Filesize

                                                              328KB

                                                            • memory/692-505-0x0000000031910000-0x000000003191D000-memory.dmp

                                                              Filesize

                                                              52KB

                                                            • memory/1344-246-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                              Filesize

                                                              392KB

                                                            • memory/1344-320-0x00000000318E0000-0x00000000318ED000-memory.dmp

                                                              Filesize

                                                              52KB

                                                            • memory/1344-506-0x0000000024080000-0x00000000240E2000-memory.dmp

                                                              Filesize

                                                              392KB

                                                            • memory/1344-507-0x00000000318E0000-0x00000000318ED000-memory.dmp

                                                              Filesize

                                                              52KB

                                                            • memory/1480-322-0x00000000240F0000-0x0000000024152000-memory.dmp

                                                              Filesize

                                                              392KB

                                                            • memory/1480-508-0x00000000240F0000-0x0000000024152000-memory.dmp

                                                              Filesize

                                                              392KB

                                                            • memory/1600-262-0x0000000000400000-0x0000000000452000-memory.dmp

                                                              Filesize

                                                              328KB

                                                            • memory/1600-229-0x0000000000400000-0x0000000000452000-memory.dmp

                                                              Filesize

                                                              328KB

                                                            • memory/1724-78-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-112-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-79-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-80-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-81-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-82-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-83-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-84-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-85-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-86-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-87-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-88-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-89-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-90-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-91-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-92-0x00000000742C0000-0x000000007486B000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1724-93-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-94-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-95-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-96-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-97-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-98-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-99-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-101-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-100-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-102-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-103-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-104-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-105-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-106-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-107-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-108-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-109-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-110-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-111-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-54-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-113-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-114-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-115-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-116-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-117-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-118-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-77-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-228-0x00000000742C0000-0x000000007486B000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1724-76-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-75-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-74-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-73-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-72-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-71-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-70-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-69-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-57-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/1724-68-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-67-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-66-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-58-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-59-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-65-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-64-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-61-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-60-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-63-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1724-62-0x0000000000860000-0x0000000000A02000-memory.dmp

                                                              Filesize

                                                              1.6MB

                                                            • memory/1932-494-0x0000000031900000-0x000000003190D000-memory.dmp

                                                              Filesize

                                                              52KB

                                                            • memory/1932-492-0x00000000731A0000-0x000000007374B000-memory.dmp

                                                              Filesize

                                                              5.7MB

                                                            • memory/1932-437-0x0000000031900000-0x000000003190D000-memory.dmp

                                                              Filesize

                                                              52KB

                                                            • memory/1932-325-0x00000000731A0000-0x000000007374B000-memory.dmp

                                                              Filesize

                                                              5.7MB