Analysis

  • max time kernel
    152s
  • max time network
    88s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 08:32

General

  • Target

    70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe

  • Size

    450KB

  • MD5

    355c77e57de2ad165d93e4199fe9b48e

  • SHA1

    38f602a53cc0803134bf7a85ea9206958168cee3

  • SHA256

    70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

  • SHA512

    e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

  • SSDEEP

    12288:xh2mjolLy9CrG6qyKvwcJFwDJ/VJ7pOZhW9Mko+os:DtB9sqyKvhwD/J7pwq

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

kaki

C2

filas0.zapto.org:82

Mutex

dll

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    smss.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    12345.0

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
    "C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
      C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:888
      • C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
        C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
        3⤵
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Drops file in Windows directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          4⤵
          • Modifies Installed Components in the registry
          PID:1976
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          4⤵
          • Loads dropped DLL
          • Drops desktop.ini file(s)
          • Drops file in Windows directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1144
          • C:\Windows\install\smss.exe
            "C:\Windows\install\smss.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:1076
            • C:\Windows\install\smss.exe
              C:\Windows\install\smss.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2024
              • C:\Windows\install\smss.exe
                C:\Windows\install\smss.exe
                7⤵
                • Executes dropped EXE
                PID:1868
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1244

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

            Filesize

            229KB

            MD5

            86f11b1da08727710f5a5e6559bf790d

            SHA1

            71d0f9193e9c2463ae3a8fc5ae3c11bb6897c858

            SHA256

            d16421e9907c580b555a93a357e00b67f18a9a2fea5a44a4fdd04c263e5bd353

            SHA512

            447dc92b6d8e057d29cd504133291ffd1a6c9ba4e52aba31a688188b4e63a92937ec61464136a4334297a465f335a05383cd953bfc7ce54170af043c61cc7aca

          • C:\Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • C:\Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • C:\Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • C:\Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • \Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • \Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • memory/888-59-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/888-66-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/888-65-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/888-54-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/888-61-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/888-55-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/888-57-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/888-87-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/1144-118-0x00000000240F0000-0x0000000024152000-memory.dmp

            Filesize

            392KB

          • memory/1144-119-0x00000000240F0000-0x0000000024152000-memory.dmp

            Filesize

            392KB

          • memory/1144-163-0x00000000240F0000-0x0000000024152000-memory.dmp

            Filesize

            392KB

          • memory/1244-94-0x0000000024010000-0x0000000024072000-memory.dmp

            Filesize

            392KB

          • memory/1976-108-0x0000000024080000-0x00000000240E2000-memory.dmp

            Filesize

            392KB

          • memory/1976-99-0x0000000074B81000-0x0000000074B83000-memory.dmp

            Filesize

            8KB

          • memory/1976-105-0x0000000024080000-0x00000000240E2000-memory.dmp

            Filesize

            392KB

          • memory/2020-72-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-78-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-89-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-86-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-113-0x00000000240F0000-0x0000000024152000-memory.dmp

            Filesize

            392KB

          • memory/2020-67-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-91-0x0000000024010000-0x0000000024072000-memory.dmp

            Filesize

            392KB

          • memory/2020-83-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-88-0x0000000075021000-0x0000000075023000-memory.dmp

            Filesize

            8KB

          • memory/2020-80-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-68-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-75-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-70-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/2020-100-0x0000000024080000-0x00000000240E2000-memory.dmp

            Filesize

            392KB

          • memory/2024-138-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/2024-137-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/2024-160-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB