Analysis

  • max time kernel
    151s
  • max time network
    172s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2022 08:37

General

  • Target

    ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe

  • Size

    400KB

  • MD5

    13693ca45e8932cb33703e42a16c7790

  • SHA1

    e1264599e0341889523ec161e25cdc5efaccc577

  • SHA256

    ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2

  • SHA512

    87ecefcd543b8ec59e9cbadec9ae72403631d39a4b403a895f49916ea8b4d2e705c22b408c3e7ad1fce928a0435827903911080270b3dbd805e59e0950e2ce56

  • SSDEEP

    6144:DYuREg+KzpmpCJKhO81+eQSQXuECLkDzBa+QxWjEi8BH/xoMHQugveLdxe:UuD+BL1lQNJCLkDtasjEi8BH/xeBeQ

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

Infected

C2

goforit.no-ip.biz:7410

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    DATAF

  • install_file

    msrcv.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    goa

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
    "C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
      C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
        • Modifies Installed Components in the registry
        • Loads dropped DLL
        PID:320
        • C:\Windows\SysWOW64\DATAF\msrcv.exe
          "C:\Windows\system32\DATAF\msrcv.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          PID:968
          • C:\Windows\SysWOW64\DATAF\msrcv.exe
            C:\Windows\SysWOW64\DATAF\msrcv.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1632
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1672
        • C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe
          "C:\Users\Admin\AppData\Local\Temp\ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2.exe"
          3⤵
          • Drops file in System32 directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:608
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1244

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      2
      T1060

      Defense Evasion

      Modify Registry

      2
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
        Filesize

        189KB

        MD5

        dc6034f89db74fdaf84a1db14c775888

        SHA1

        af5763839809e8a2870ca3598d852b048b720b6a

        SHA256

        adc4be444ed0760682567c28a908a7b4452887a720f35a915d17de5610a72a82

        SHA512

        01be0f17038c08483a43ca7ae86d58b6d45747972181353ff79e76761fe2eae111879d7aae82538833363a348811028bb149d732c9eb07f36a147e1e93e5eacd

      • C:\Windows\SysWOW64\DATAF\msrcv.exe
        Filesize

        400KB

        MD5

        13693ca45e8932cb33703e42a16c7790

        SHA1

        e1264599e0341889523ec161e25cdc5efaccc577

        SHA256

        ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2

        SHA512

        87ecefcd543b8ec59e9cbadec9ae72403631d39a4b403a895f49916ea8b4d2e705c22b408c3e7ad1fce928a0435827903911080270b3dbd805e59e0950e2ce56

      • C:\Windows\SysWOW64\DATAF\msrcv.exe
        Filesize

        400KB

        MD5

        13693ca45e8932cb33703e42a16c7790

        SHA1

        e1264599e0341889523ec161e25cdc5efaccc577

        SHA256

        ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2

        SHA512

        87ecefcd543b8ec59e9cbadec9ae72403631d39a4b403a895f49916ea8b4d2e705c22b408c3e7ad1fce928a0435827903911080270b3dbd805e59e0950e2ce56

      • C:\Windows\SysWOW64\DATAF\msrcv.exe
        Filesize

        400KB

        MD5

        13693ca45e8932cb33703e42a16c7790

        SHA1

        e1264599e0341889523ec161e25cdc5efaccc577

        SHA256

        ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2

        SHA512

        87ecefcd543b8ec59e9cbadec9ae72403631d39a4b403a895f49916ea8b4d2e705c22b408c3e7ad1fce928a0435827903911080270b3dbd805e59e0950e2ce56

      • \Windows\SysWOW64\DATAF\msrcv.exe
        Filesize

        400KB

        MD5

        13693ca45e8932cb33703e42a16c7790

        SHA1

        e1264599e0341889523ec161e25cdc5efaccc577

        SHA256

        ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2

        SHA512

        87ecefcd543b8ec59e9cbadec9ae72403631d39a4b403a895f49916ea8b4d2e705c22b408c3e7ad1fce928a0435827903911080270b3dbd805e59e0950e2ce56

      • \Windows\SysWOW64\DATAF\msrcv.exe
        Filesize

        400KB

        MD5

        13693ca45e8932cb33703e42a16c7790

        SHA1

        e1264599e0341889523ec161e25cdc5efaccc577

        SHA256

        ee9564a5cf6d6bd545264be766c4a8997abde1c24e79b21614d0af3c4caad5f2

        SHA512

        87ecefcd543b8ec59e9cbadec9ae72403631d39a4b403a895f49916ea8b4d2e705c22b408c3e7ad1fce928a0435827903911080270b3dbd805e59e0950e2ce56

      • memory/320-109-0x00000000034D0000-0x0000000003539000-memory.dmp
        Filesize

        420KB

      • memory/320-79-0x0000000000000000-mapping.dmp
      • memory/320-90-0x0000000024060000-0x00000000240A2000-memory.dmp
        Filesize

        264KB

      • memory/320-136-0x00000000034D0000-0x0000000003539000-memory.dmp
        Filesize

        420KB

      • memory/320-87-0x0000000024060000-0x00000000240A2000-memory.dmp
        Filesize

        264KB

      • memory/320-81-0x00000000747A1000-0x00000000747A3000-memory.dmp
        Filesize

        8KB

      • memory/320-112-0x00000000034D0000-0x0000000003539000-memory.dmp
        Filesize

        420KB

      • memory/608-133-0x0000000024100000-0x0000000024142000-memory.dmp
        Filesize

        264KB

      • memory/608-99-0x0000000000400000-0x0000000000469000-memory.dmp
        Filesize

        420KB

      • memory/608-97-0x0000000000000000-mapping.dmp
      • memory/608-116-0x0000000024100000-0x0000000024142000-memory.dmp
        Filesize

        264KB

      • memory/608-137-0x0000000024100000-0x0000000024142000-memory.dmp
        Filesize

        264KB

      • memory/968-130-0x0000000000400000-0x0000000000469000-memory.dmp
        Filesize

        420KB

      • memory/968-115-0x0000000000400000-0x0000000000469000-memory.dmp
        Filesize

        420KB

      • memory/968-104-0x0000000000000000-mapping.dmp
      • memory/1244-76-0x0000000024010000-0x0000000024052000-memory.dmp
        Filesize

        264KB

      • memory/1628-68-0x0000000000400000-0x0000000000469000-memory.dmp
        Filesize

        420KB

      • memory/1628-55-0x0000000000220000-0x0000000000230000-memory.dmp
        Filesize

        64KB

      • memory/1632-132-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1632-135-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1632-127-0x000000000040BBE4-mapping.dmp
      • memory/1632-134-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-91-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-98-0x0000000001BC0000-0x0000000001C29000-memory.dmp
        Filesize

        420KB

      • memory/1724-93-0x00000000240B0000-0x00000000240F2000-memory.dmp
        Filesize

        264KB

      • memory/1724-102-0x0000000024100000-0x0000000024142000-memory.dmp
        Filesize

        264KB

      • memory/1724-82-0x0000000024060000-0x00000000240A2000-memory.dmp
        Filesize

        264KB

      • memory/1724-73-0x0000000024010000-0x0000000024052000-memory.dmp
        Filesize

        264KB

      • memory/1724-71-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-70-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-114-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-69-0x00000000757B1000-0x00000000757B3000-memory.dmp
        Filesize

        8KB

      • memory/1724-67-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-66-0x000000000040BBE4-mapping.dmp
      • memory/1724-65-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-63-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-62-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-61-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-60-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-59-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-57-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB

      • memory/1724-56-0x0000000000400000-0x0000000000444000-memory.dmp
        Filesize

        272KB