Analysis

  • max time kernel
    152s
  • max time network
    86s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2022 13:21

General

  • Target

    d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe

  • Size

    329KB

  • MD5

    d81aa34710888a76491288206f518bad

  • SHA1

    a1f71390ee3eac9a137710438fbae13d98241064

  • SHA256

    d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

  • SHA512

    6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

  • SSDEEP

    6144:58JvgCv/j9b8KgFXibaVPhsHMwq2VWU/5kWjRJHbBYseP4fJpS9snJ4rbDMf1N:YFJbDgFXFvwq2VWS9YuJp5n+DON

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Infected

C2

127.0.0.1:999

nothinghack.no-ip.biz:81

Mutex

YR5E1N04M47V5M

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    iexplorer

  • install_file

    iexplorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe
    "C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe
      "C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe"
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
        • Modifies Installed Components in the registry
        • Suspicious use of AdjustPrivilegeToken
        PID:1000
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:336
        • C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe
          "C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe"
          3⤵
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1716
          • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
            "C:\Windows\system32\iexplorer\iexplorer.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:1720
            • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
              "C:\Windows\SysWOW64\iexplorer\iexplorer.exe"
              5⤵
              • Executes dropped EXE
              PID:1600
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1272

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      3
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Admin2.txt
        Filesize

        224KB

        MD5

        26890c191523b825e49a03866dc552dc

        SHA1

        f879cf399fe57eaffdfdd08d34b5ba13c590000a

        SHA256

        9bbc2cedb6d8c46cca0fdef07fa53f3c2781e159986ae295e3b7e93e0cba7749

        SHA512

        235f71409fa8c266273910f7228468c058130533273008bb4263ccaf85a2db2e534fc7d180dba4ca5f72ef7c2afc3c2ae4ce5460870e27f3986f6a0cd4366849

      • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
        Filesize

        329KB

        MD5

        d81aa34710888a76491288206f518bad

        SHA1

        a1f71390ee3eac9a137710438fbae13d98241064

        SHA256

        d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

        SHA512

        6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

      • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
        Filesize

        329KB

        MD5

        d81aa34710888a76491288206f518bad

        SHA1

        a1f71390ee3eac9a137710438fbae13d98241064

        SHA256

        d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

        SHA512

        6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

      • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
        Filesize

        329KB

        MD5

        d81aa34710888a76491288206f518bad

        SHA1

        a1f71390ee3eac9a137710438fbae13d98241064

        SHA256

        d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

        SHA512

        6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

      • \Windows\SysWOW64\iexplorer\iexplorer.exe
        Filesize

        329KB

        MD5

        d81aa34710888a76491288206f518bad

        SHA1

        a1f71390ee3eac9a137710438fbae13d98241064

        SHA256

        d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

        SHA512

        6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

      • \Windows\SysWOW64\iexplorer\iexplorer.exe
        Filesize

        329KB

        MD5

        d81aa34710888a76491288206f518bad

        SHA1

        a1f71390ee3eac9a137710438fbae13d98241064

        SHA256

        d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

        SHA512

        6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

      • memory/1000-80-0x0000000010480000-0x00000000104E5000-memory.dmp
        Filesize

        404KB

      • memory/1000-77-0x0000000010480000-0x00000000104E5000-memory.dmp
        Filesize

        404KB

      • memory/1000-69-0x0000000000000000-mapping.dmp
      • memory/1000-71-0x0000000075301000-0x0000000075303000-memory.dmp
        Filesize

        8KB

      • memory/1272-66-0x0000000010410000-0x0000000010475000-memory.dmp
        Filesize

        404KB

      • memory/1516-61-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/1516-63-0x0000000010410000-0x0000000010475000-memory.dmp
        Filesize

        404KB

      • memory/1516-59-0x0000000075C81000-0x0000000075C83000-memory.dmp
        Filesize

        8KB

      • memory/1516-57-0x000000000040E1A8-mapping.dmp
      • memory/1516-82-0x00000000104F0000-0x0000000010555000-memory.dmp
        Filesize

        404KB

      • memory/1516-56-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/1516-88-0x0000000010560000-0x00000000105C5000-memory.dmp
        Filesize

        404KB

      • memory/1516-94-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/1516-72-0x0000000010480000-0x00000000104E5000-memory.dmp
        Filesize

        404KB

      • memory/1516-58-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/1516-60-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/1600-103-0x000000000040E1A8-mapping.dmp
      • memory/1600-107-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/1600-108-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/1600-109-0x0000000000400000-0x000000000044F000-memory.dmp
        Filesize

        316KB

      • memory/1716-95-0x0000000010560000-0x00000000105C5000-memory.dmp
        Filesize

        404KB

      • memory/1716-93-0x0000000010560000-0x00000000105C5000-memory.dmp
        Filesize

        404KB

      • memory/1716-86-0x0000000000000000-mapping.dmp
      • memory/1716-110-0x0000000010560000-0x00000000105C5000-memory.dmp
        Filesize

        404KB

      • memory/1720-98-0x0000000000000000-mapping.dmp