Analysis

  • max time kernel
    157s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 08:32

General

  • Target

    70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe

  • Size

    450KB

  • MD5

    355c77e57de2ad165d93e4199fe9b48e

  • SHA1

    38f602a53cc0803134bf7a85ea9206958168cee3

  • SHA256

    70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

  • SHA512

    e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

  • SSDEEP

    12288:xh2mjolLy9CrG6qyKvwcJFwDJ/VJ7pOZhW9Mko+os:DtB9sqyKvhwD/J7pwq

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

kaki

C2

filas0.zapto.org:82

Mutex

dll

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    smss.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    12345.0

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2416
      • C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
        "C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3364
        • C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
          C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
            C:\Users\Admin\AppData\Local\Temp\70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6.exe
            4⤵
            • Adds policy Run key to start application
            • Modifies Installed Components in the registry
            • Drops file in Windows directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4808
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Modifies Installed Components in the registry
              PID:3956
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2156
              • C:\Windows\install\smss.exe
                "C:\Windows\install\smss.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4384
                • C:\Windows\install\smss.exe
                  C:\Windows\install\smss.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2320
                  • C:\Windows\install\smss.exe
                    C:\Windows\install\smss.exe
                    8⤵
                    • Executes dropped EXE
                    PID:4380

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

            Filesize

            229KB

            MD5

            86f11b1da08727710f5a5e6559bf790d

            SHA1

            71d0f9193e9c2463ae3a8fc5ae3c11bb6897c858

            SHA256

            d16421e9907c580b555a93a357e00b67f18a9a2fea5a44a4fdd04c263e5bd353

            SHA512

            447dc92b6d8e057d29cd504133291ffd1a6c9ba4e52aba31a688188b4e63a92937ec61464136a4334297a465f335a05383cd953bfc7ce54170af043c61cc7aca

          • C:\Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • C:\Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • C:\Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • C:\Windows\install\smss.exe

            Filesize

            450KB

            MD5

            355c77e57de2ad165d93e4199fe9b48e

            SHA1

            38f602a53cc0803134bf7a85ea9206958168cee3

            SHA256

            70fb59af7a390e56dc2c0017e49086cf1444c2fb14239c339dbaaf9468c773a6

            SHA512

            e9d4b4641dab8bf6e2fb2bb94f9ef89ec206bf0068e85f1c8378be0ec9009e30ee08411bcf0e7eddc1bf52296ecb5a7911d762652091e66bc1f024a1add60ee9

          • memory/2156-172-0x00000000240F0000-0x0000000024152000-memory.dmp

            Filesize

            392KB

          • memory/2156-200-0x00000000240F0000-0x0000000024152000-memory.dmp

            Filesize

            392KB

          • memory/2156-171-0x00000000240F0000-0x0000000024152000-memory.dmp

            Filesize

            392KB

          • memory/2320-184-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/2320-183-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/2320-197-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/3956-163-0x0000000024080000-0x00000000240E2000-memory.dmp

            Filesize

            392KB

          • memory/3956-199-0x0000000024080000-0x00000000240E2000-memory.dmp

            Filesize

            392KB

          • memory/3956-162-0x0000000024080000-0x00000000240E2000-memory.dmp

            Filesize

            392KB

          • memory/4380-198-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4808-144-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4808-154-0x0000000024010000-0x0000000024072000-memory.dmp

            Filesize

            392KB

          • memory/4808-152-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4808-168-0x00000000240F0000-0x0000000024152000-memory.dmp

            Filesize

            392KB

          • memory/4808-159-0x0000000024080000-0x00000000240E2000-memory.dmp

            Filesize

            392KB

          • memory/4808-151-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4808-148-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4808-147-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4808-146-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4808-141-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4808-142-0x0000000000400000-0x000000000044E000-memory.dmp

            Filesize

            312KB

          • memory/4884-150-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/4884-139-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/4884-138-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/4884-135-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/4884-134-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB

          • memory/4884-133-0x0000000000400000-0x000000000046E000-memory.dmp

            Filesize

            440KB