Analysis

  • max time kernel
    155s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-12-2022 13:21

General

  • Target

    d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe

  • Size

    329KB

  • MD5

    d81aa34710888a76491288206f518bad

  • SHA1

    a1f71390ee3eac9a137710438fbae13d98241064

  • SHA256

    d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

  • SHA512

    6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

  • SSDEEP

    6144:58JvgCv/j9b8KgFXibaVPhsHMwq2VWU/5kWjRJHbBYseP4fJpS9snJ4rbDMf1N:YFJbDgFXFvwq2VWS9YuJp5n+DON

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Infected

C2

127.0.0.1:999

nothinghack.no-ip.biz:81

Mutex

YR5E1N04M47V5M

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    iexplorer

  • install_file

    iexplorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:532
      • C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe
        "C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1108
        • C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe
          "C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            • Suspicious use of AdjustPrivilegeToken
            PID:508
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:812
            • C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe
              "C:\Users\Admin\AppData\Local\Temp\d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4420
              • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
                "C:\Windows\system32\iexplorer\iexplorer.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:4716
                • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
                  "C:\Windows\SysWOW64\iexplorer\iexplorer.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:4708
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 588
                    7⤵
                    • Program crash
                    PID:1732
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4708 -ip 4708
        1⤵
          PID:4128

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        3
        T1060

        Defense Evasion

        Modify Registry

        3
        T1112

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Admin2.txt
          Filesize

          224KB

          MD5

          26890c191523b825e49a03866dc552dc

          SHA1

          f879cf399fe57eaffdfdd08d34b5ba13c590000a

          SHA256

          9bbc2cedb6d8c46cca0fdef07fa53f3c2781e159986ae295e3b7e93e0cba7749

          SHA512

          235f71409fa8c266273910f7228468c058130533273008bb4263ccaf85a2db2e534fc7d180dba4ca5f72ef7c2afc3c2ae4ce5460870e27f3986f6a0cd4366849

        • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
          Filesize

          329KB

          MD5

          d81aa34710888a76491288206f518bad

          SHA1

          a1f71390ee3eac9a137710438fbae13d98241064

          SHA256

          d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

          SHA512

          6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

        • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
          Filesize

          329KB

          MD5

          d81aa34710888a76491288206f518bad

          SHA1

          a1f71390ee3eac9a137710438fbae13d98241064

          SHA256

          d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

          SHA512

          6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

        • C:\Windows\SysWOW64\iexplorer\iexplorer.exe
          Filesize

          329KB

          MD5

          d81aa34710888a76491288206f518bad

          SHA1

          a1f71390ee3eac9a137710438fbae13d98241064

          SHA256

          d2b6ef9a21560ab67f186cd7f0be32400ebe559fda2b22c6687b0fa0a7e66c33

          SHA512

          6c862ecf2d7c69426fb3a53fddb9b2b3fa65bad11a83f025ea95ba705b5e53119249890c86d49b4831849dae8bb39b9543d00c4522ca1608954b2debbd686b86

        • memory/508-144-0x0000000000000000-mapping.dmp
        • memory/508-148-0x0000000010480000-0x00000000104E5000-memory.dmp
          Filesize

          404KB

        • memory/508-164-0x0000000010480000-0x00000000104E5000-memory.dmp
          Filesize

          404KB

        • memory/508-149-0x0000000010480000-0x00000000104E5000-memory.dmp
          Filesize

          404KB

        • memory/1496-162-0x0000000000400000-0x000000000044F000-memory.dmp
          Filesize

          316KB

        • memory/1496-135-0x0000000000400000-0x000000000044F000-memory.dmp
          Filesize

          316KB

        • memory/1496-151-0x00000000104F0000-0x0000000010555000-memory.dmp
          Filesize

          404KB

        • memory/1496-138-0x0000000000400000-0x000000000044F000-memory.dmp
          Filesize

          316KB

        • memory/1496-137-0x0000000000400000-0x000000000044F000-memory.dmp
          Filesize

          316KB

        • memory/1496-134-0x0000000000000000-mapping.dmp
        • memory/1496-158-0x0000000010560000-0x00000000105C5000-memory.dmp
          Filesize

          404KB

        • memory/1496-140-0x0000000010410000-0x0000000010475000-memory.dmp
          Filesize

          404KB

        • memory/1496-136-0x0000000000400000-0x000000000044F000-memory.dmp
          Filesize

          316KB

        • memory/1496-145-0x0000000010480000-0x00000000104E5000-memory.dmp
          Filesize

          404KB

        • memory/4420-163-0x0000000010560000-0x00000000105C5000-memory.dmp
          Filesize

          404KB

        • memory/4420-161-0x0000000010560000-0x00000000105C5000-memory.dmp
          Filesize

          404KB

        • memory/4420-157-0x0000000000000000-mapping.dmp
        • memory/4420-174-0x0000000010560000-0x00000000105C5000-memory.dmp
          Filesize

          404KB

        • memory/4708-169-0x0000000000000000-mapping.dmp
        • memory/4708-173-0x0000000000400000-0x000000000044F000-memory.dmp
          Filesize

          316KB

        • memory/4708-175-0x0000000000400000-0x000000000044F000-memory.dmp
          Filesize

          316KB

        • memory/4708-176-0x0000000000400000-0x000000000044F000-memory.dmp
          Filesize

          316KB

        • memory/4716-165-0x0000000000000000-mapping.dmp