Analysis

  • max time kernel
    162s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2022 18:10

General

  • Target

    12193c733668672c9e6b88abb40d99c1d22679d84d619666ffc1b0b5c974a453.exe

  • Size

    784KB

  • MD5

    851de3d0db1b2ffe29414cb75715473f

  • SHA1

    cc645d4b3426d7073f02b1c4db6858c64e10997b

  • SHA256

    12193c733668672c9e6b88abb40d99c1d22679d84d619666ffc1b0b5c974a453

  • SHA512

    8a47fc7c739ddeae734896deb470e2282a37b574c19ca351d5b646df901475f3eda536161a0e80af0fb1c6a4db5fb9947618420be48584767daf622d5944b044

  • SSDEEP

    12288:qX3RvFGVNZxSvfdFPBsojcerNjwS4TV13rYeAiS34nua3sB8ezehm/P:qXPuNeLB7rSbXkxihtk8G/

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

10

C2

googleud7.dyndns-server.com:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    win64ini

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1224
      • C:\Users\Admin\AppData\Local\Temp\12193c733668672c9e6b88abb40d99c1d22679d84d619666ffc1b0b5c974a453.exe
        "C:\Users\Admin\AppData\Local\Temp\12193c733668672c9e6b88abb40d99c1d22679d84d619666ffc1b0b5c974a453.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:836
        • C:\Users\Admin\AppData\Local\Temp\12193c733668672c9e6b88abb40d99c1d22679d84d619666ffc1b0b5c974a453.exe
          "C:\Users\Admin\AppData\Local\Temp\12193c733668672c9e6b88abb40d99c1d22679d84d619666ffc1b0b5c974a453.exe"
          3⤵
          • Loads dropped DLL
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1040
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\pass.txt
            4⤵
            • Opens file in notepad (likely ransom note)
            PID:1864
          • C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
            "C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:548
            • C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
              "C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:800
              • C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
                "C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe"
                6⤵
                • Adds policy Run key to start application
                • Executes dropped EXE
                • Modifies Installed Components in the registry
                • Loads dropped DLL
                • Adds Run key to start application
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:1316
                • C:\Windows\SysWOW64\explorer.exe
                  explorer.exe
                  7⤵
                  • Modifies Installed Components in the registry
                  PID:1636
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  7⤵
                    PID:1592
                  • C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
                    "C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe"
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1776
                    • C:\Windows\SysWOW64\win64ini\svchost.exe
                      "C:\Windows\system32\win64ini\svchost.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of SetWindowsHookEx
                      PID:1340
                      • C:\Windows\SysWOW64\win64ini\svchost.exe
                        "C:\Windows\system32\win64ini\svchost.exe"
                        9⤵
                        • Executes dropped EXE
                        • Writes to the Master Boot Record (MBR)
                        • Suspicious use of SetThreadContext
                        • Suspicious use of SetWindowsHookEx
                        PID:556
                        • C:\Windows\SysWOW64\win64ini\svchost.exe
                          "C:\Windows\system32\win64ini\svchost.exe"
                          10⤵
                          • Executes dropped EXE
                          PID:1656

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      3
      T1060

      Bootkit

      1
      T1067

      Defense Evasion

      Modify Registry

      3
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
        Filesize

        229KB

        MD5

        0a26abcc3540ad0383c3289473e6fea1

        SHA1

        954768424d734662621ab6f34c1697dde5f10d8c

        SHA256

        aaacc6ba6ef1468ea79ce5d57106e51a57963eab2bcf33d07cac710adc718a70

        SHA512

        1257347d808022ed54b1f557a36e05ab0e8748332fd0b7e6a8af7082af10a99441d621c20e6ad770e7a9a19989bd381669038b4a4c084593468d03b7484f1d4d

      • C:\Users\Admin\AppData\Local\Temp\pass.txt
        Filesize

        70B

        MD5

        94358c9cae9d607c92ec7abb690fd878

        SHA1

        75b0850e420c767372fb79bcb0e66d72b17b0928

        SHA256

        a5c52ea19fff5d6036258543703dfb8d497146c4b733e739a2e6f72d81ea1fc0

        SHA512

        011280ad139053c2b63162294f322e6f79ad35d3305ce83bda4620a6dc568e7d76e5f951d5b0c462cc3f2591cd7fd1bcf81518233404dc821f9defa8f3cefa21

      • C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • C:\Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • C:\Windows\SysWOW64\win64ini\svchost.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • C:\Windows\SysWOW64\win64ini\svchost.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • C:\Windows\SysWOW64\win64ini\svchost.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • C:\Windows\SysWOW64\win64ini\svchost.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • \Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • \Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • \Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • \Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • \Users\Admin\AppData\Local\Temp\wT4TL34z7.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • \Windows\SysWOW64\win64ini\svchost.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • \Windows\SysWOW64\win64ini\svchost.exe
        Filesize

        528KB

        MD5

        211dbd8ff924d5c521bde7db76f5358a

        SHA1

        2a7025880684953184087537fad6b7e8f4565634

        SHA256

        8800ca881f80dfaa3b73b8df14a45f7466db51dd05e48a385b76e4a14318727c

        SHA512

        c664023d8d71fd7566241ee6e61dd87060effedd1bac85168a4edf3d13b15b5424620b50fa096daf98bd022811c1d867839374c6cceb191926a2bf13b62ecca2

      • memory/548-75-0x0000000000000000-mapping.dmp
      • memory/556-158-0x0000000000401844-mapping.dmp
      • memory/556-174-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/556-176-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/800-88-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/800-89-0x0000000000401844-mapping.dmp
      • memory/800-85-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/800-83-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/800-82-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/800-103-0x0000000000400000-0x0000000000451000-memory.dmp
        Filesize

        324KB

      • memory/1040-69-0x0000000000400000-0x0000000000490000-memory.dmp
        Filesize

        576KB

      • memory/1040-68-0x0000000075C81000-0x0000000075C83000-memory.dmp
        Filesize

        8KB

      • memory/1040-77-0x0000000000400000-0x0000000000490000-memory.dmp
        Filesize

        576KB

      • memory/1040-67-0x0000000000400000-0x0000000000490000-memory.dmp
        Filesize

        576KB

      • memory/1040-56-0x0000000000400000-0x0000000000490000-memory.dmp
        Filesize

        576KB

      • memory/1040-63-0x0000000000401844-mapping.dmp
      • memory/1040-62-0x0000000000400000-0x0000000000490000-memory.dmp
        Filesize

        576KB

      • memory/1040-59-0x0000000000400000-0x0000000000490000-memory.dmp
        Filesize

        576KB

      • memory/1040-57-0x0000000000400000-0x0000000000490000-memory.dmp
        Filesize

        576KB

      • memory/1224-113-0x0000000024010000-0x0000000024072000-memory.dmp
        Filesize

        392KB

      • memory/1316-106-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1316-98-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1316-95-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1316-96-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1316-119-0x0000000024080000-0x00000000240E2000-memory.dmp
        Filesize

        392KB

      • memory/1316-99-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1316-129-0x00000000240F0000-0x0000000024152000-memory.dmp
        Filesize

        392KB

      • memory/1316-110-0x0000000024010000-0x0000000024072000-memory.dmp
        Filesize

        392KB

      • memory/1316-100-0x0000000000455BF0-mapping.dmp
      • memory/1316-108-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1316-137-0x0000000024160000-0x00000000241C2000-memory.dmp
        Filesize

        392KB

      • memory/1316-143-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1316-104-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1316-107-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1340-147-0x0000000000000000-mapping.dmp
      • memory/1636-116-0x0000000000000000-mapping.dmp
      • memory/1636-124-0x0000000024080000-0x00000000240E2000-memory.dmp
        Filesize

        392KB

      • memory/1636-118-0x0000000074431000-0x0000000074433000-memory.dmp
        Filesize

        8KB

      • memory/1636-127-0x0000000024080000-0x00000000240E2000-memory.dmp
        Filesize

        392KB

      • memory/1656-175-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1656-168-0x0000000000455BF0-mapping.dmp
      • memory/1656-178-0x0000000000400000-0x0000000000457000-memory.dmp
        Filesize

        348KB

      • memory/1776-134-0x0000000000000000-mapping.dmp
      • memory/1776-142-0x0000000024160000-0x00000000241C2000-memory.dmp
        Filesize

        392KB

      • memory/1776-144-0x0000000024160000-0x00000000241C2000-memory.dmp
        Filesize

        392KB

      • memory/1776-177-0x0000000024160000-0x00000000241C2000-memory.dmp
        Filesize

        392KB

      • memory/1864-70-0x0000000000000000-mapping.dmp